Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-3430

Webwork 2 code injection vulnerability

XMLWordPrintable

      We have discovered a vulnerability in WebWork 2, which is a part of the Struts web framework.

      In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks.

      In case of Crowd, the attacker needs to be able to access Crowd Web interface. A valid user account is not is required to exploit this vulnerability.

      Customers should be advised that this effects all previously released versions of standalone Crowd server, except Crowd
      2.3.9, 2.4.10, 2.5.5, 2.6.4, or later. Standalone Crowd is not used in OnDemand.

      For more information on this issue, please see the security advisory here.

          Form Name

            [CWD-3430] Webwork 2 code injection vulnerability

            Gavad Khan (PS) added a comment -

            Great thanks Joseph for your quick response.

            Gavad Khan (PS) added a comment - Great thanks Joseph for your quick response.

            joe added a comment -

            Yes, the WAR distribution should also be upgraded to pick up this fix.

            joe added a comment - Yes, the WAR distribution should also be upgraded to pick up this fix.

            Gavad Khan (PS) added a comment -

            We have deployed below Crowd 2.4.2 WAR distribution (not standalone Crowd). Is this also affected?

            Gavad Khan (PS) added a comment - We have deployed below Crowd 2.4.2 WAR distribution (not standalone Crowd). Is this also affected? http://www.atlassian.com/software/crowd/downloads/binary/atlassian-crowd-2.4.2-war.zip

              Unassigned Unassigned
              vosipov VitalyA
              Affected customers:
              0 This affects my team
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: