Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-4790

CVE-2016-6496: LDAP Java Object Injection in Crowd

XMLWordPrintable

      The Crowd LDAP directory connector allowed an attacker to gain remote code execution in Crowd by injecting malicious attributes in LDAP entries. To exploit this issue, attackers need to modify an entry in your LDAP directory or successfully execute a Man-in-The-Middle attack between an LDAP server and Crowd. Crowd installations configured to communicate with an LDAP server using the LDAPS protocol with the Secure SSL option enabled are immune to this attack vector only (unless an attacker is able to obtain the private key of the SSL/TLS certificate used to secure the communication).

      Affected versions:

      • All versions of Crowd from 1.4.1 before 2.8.8 (the fixed version for 2.8.x) and from 2.9.0 before 2.9.5 (the fixed version for 2.9.x) are affected by this vulnerability.

      Fix:

      Risk Mitigation:

      • The issue can be mitigated by restricting modifications of LDAP entries by LDAP users and configuring SSL/TLS connection between an LDAP Server and Crowd. See Configuring Crowd to Work with SSL for information on setting up secure transport.


      Acknowledgements:
      We would like to credit Alvaro Munoz and Alexander Mirosh of HPE Security Fortify for reporting this issue to us.


      For additional details see the full advisory.

          Form Name

            [CWD-4790] CVE-2016-6496: LDAP Java Object Injection in Crowd

            David Black added a comment - - edited

            CVSS v3 score: 9.0 => Critical severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity High
            Privileges Required None
            User Interaction None

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality High
            Integrity High
            Availability High

            See https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H for more details.

            David Black added a comment - - edited CVSS v3 score: 9.0 => Critical severity Exploitability Metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction None Scope Metric Scope Changed Impact Metrics Confidentiality High Integrity High Availability High See https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H for more details.

              Unassigned Unassigned
              a0293d379a6e Alvaro Munoz
              Affected customers:
              0 This affects my team
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: