CVE-2022-43782critical

CVE-2022-43782: critical vulnerability in Atlassian Crowd Data Center

Published · Updated

Follow this CVE+ Monitor Crowd Data Center+ Monitor Crowd Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.0%
Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Atlassian · Crowd Data CenterAtlassian · Crowd Server
Related CVEs — Atlassian Crowd Data Center

In the same product, most dangerous first.

CVE-2026-21589CRITICALCVE-2026-21589EPSS 99.7%KEVCVE-2022-26136CRITICALCVE-2022-26136EPSS 5.7%CVE-2022-26137HIGHCVE-2022-26137EPSS 2.4%CVE-2023-22521HIGHCVE-2023-22521EPSS 1.2%CVE-2026-21582HIGHCVE-2026-21582EPSS 0.5%CVE-2026-21569HIGHCVE-2026-21569EPSS 0.3%