This High severity Insecure Deserialization vulnerability was introduced in versions 6.0.0, 6.1.0, 6.2.0, 6.3.6, 7.0.0,
7.1.0, and 7.2.0 of Crowd Data Center.

This Insecure Deserialization vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H allows an unauthenticated attacker to expose assets in
your environment susceptible to exploitation which has high impact to confidentiality, high impact to integrity, high impact
to availability, and requires no user interaction.

Atlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade
your instance to one of the specified supported fixed versions:

• Crowd Data Center 7.2: Upgrade to a release greater than or equal to 7.2.2

See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the
latest version of Crowd Data Center from the download center
(https://www.atlassian.com/software/crowd/download-archive).

The National Vulnerability Database provides the following description for this vulnerability:

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From
2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any
array type based only on clazz.isArray(), without validating the array's component (element) type against the configured
allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits
EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs
are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This
vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.