PT-2018-6346 · Atlassian+1 · Crowd+1
Patryk
·
Publicado
2018-01-31
·
Atualizado
2019-10-09
·
CVE-2017-16858
CVSS v3.1
6.8
Média
| Vetor | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
Atlassian Crowd versions 1.5.0 through 3.1.2
Description:
The issue allows an attacker to impersonate a Crowd user in REST requests by authenticating to a directory bound to an application. This can occur when the Crowd application is bound to one directory and another application, such as Google Apps, is bound to a different directory, both having users with the same name. The attacker can then use the credentials of the user from the second directory to impersonate the user from the first directory.
Recommendations:
For Atlassian Crowd versions 1.5.0 through 3.1.2, update to version 3.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the
crowd-application plugin module until the update is applied.Correção
Incorrect Authorization
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Crowd
Google Apps