Vulnerability Description
Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Crowd | >= 3.0.0, < 4.4.4 |
References
- https://jira.atlassian.com/browse/CWD-5888Issue TrackingPatchVendor Advisory
- https://jira.atlassian.com/browse/CWD-5888Issue TrackingPatchVendor Advisory
FAQ
What is CVE-2022-43782?
CVE-2022-43782 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API un...
How severe is CVE-2022-43782?
CVE-2022-43782 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-43782?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Crowd.