Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-3904

ClassLoader manipulation vulnerability

XMLWordPrintable

      We have fixed a vulnerability in our fork of Apache Struts. Attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. The attacker needs to be able to access the Crowd web interface. In cases when anonymous access is enabled, a valid user account is not required to exploit this vulnerability.

      We have discovered this vulnerability during our review of the recent Struts security advisories. This vulnerability is specific to Crowd.

      The vulnerability affects all supported version of Crowd. For more information see the full advisory.

            [CWD-3904] ClassLoader manipulation vulnerability

            Monique Khairuliana (Inactive) made changes -
            Workflow Original: Simplified Crowd Development Workflow v2 - restricted [ 1511133 ] New: JAC Bug Workflow v3 [ 3365440 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Rachel Robins made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 202974 ] New: This issue links to "Page (Atlassian Documentation)" [ 202974 ]
            Rachel Robins made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 202974 ]
            Wazza made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 194869 ] New: This issue links to "Page (Atlassian Documentation)" [ 194869 ]
            Wazza made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 194869 ]
            Owen made changes -
            Workflow Original: Simplified Crowd Development Workflow v2 [ 1393293 ] New: Simplified Crowd Development Workflow v2 - restricted [ 1511133 ]
            Owen made changes -
            Workflow Original: Crowd Development Workflow v2 [ 685620 ] New: Simplified Crowd Development Workflow v2 [ 1393293 ]
            Andrew made changes -
            Remote Link Original: This issue links to "Page (Atlassian Documentation)" [ 170069 ] New: This issue links to "Page (Atlassian Documentation)" [ 170069 ]
            Andrew made changes -
            Remote Link New: This issue links to "Page (Atlassian Documentation)" [ 170069 ]
            Craig Davies (Inactive) made changes -
            Remote Link Original: This issue links to "Page (Extranet)" [ 65210 ] New: This issue links to "Page (Extranet)" [ 65210 ]

              dberrueta Diego Berrueta
              vosipov VitalyA
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: