← Retour aux CVEs

CVE-2019-11580

CRITICALCISA KEV

9.8

Description

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie6/3/2019

Derniere modification10/24/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurAtlassian

ProduitCrowd and Crowd Data Center

Nom vulnerabiliteAtlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

Date ajout KEV2021-11-03

Date limite remediation2022-05-03

Utilise dans ransomwareKnown

Produits affectes

atlassian:crowd

References

http://packetstormsecurity.com/files/163810/Atlassian-Crowd-pdkinstall-Remote-Code-Execution.html(security@atlassian.com)

http://www.securityfocus.com/bid/108637(security@atlassian.com)

https://jira.atlassian.com/browse/CWD-5388(security@atlassian.com)

http://packetstormsecurity.com/files/163810/Atlassian-Crowd-pdkinstall-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/108637(af854a3a-2127-422b-91ae-364da2661108)

https://jira.atlassian.com/browse/CWD-5388(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11580(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.