CVE-2019-20902 Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.
HighCVSS 7.5
EPSS 0.87%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian crowd | < 3.4.6 | 3.4.6 |
| atlassian crowd | >= 3.5.0, < 3.5.1 | 3.5.1 |
| atlassian crowd | >= 3.5.0 | No fix listed |
| atlassian crowd | < 3.5.1 | 3.5.1 |
References
- jira.atlassian.com vendor-advisory