CVE-2016-6496 The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka L...
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian crowd | <= 2.8.4 | No fix listed |
| atlassian crowd | = 2.9.0 | No fix listed |
| atlassian crowd | = 2.9.1 | No fix listed |
References
- 20161031 October 2016 - Crowd - Critical Security Advisory mailing-list
- 93826 third-party-advisory vdb-entry
- confluence.atlassian.com vendor-advisory
- jira.atlassian.com issue-tracking
- www.blackhat.com not-applicable