CVE-2022-43782critical

CVE-2022-43782: fallo crítico en Atlassian Crowd Data Center

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Crowd Data Center+ Monitorear Crowd Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 1.0%
Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Atlassian · Crowd Data CenterAtlassian · Crowd Server
CVEs relacionadas — Atlassian Crowd Data Center

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-21589CRITICALCVE-2026-21589EPSS 99.5%KEVCVE-2022-26136CRITICALCVE-2022-26136EPSS 5.7%CVE-2022-26137HIGHCVE-2022-26137EPSS 2.4%CVE-2023-22521HIGHCVE-2023-22521EPSS 1.2%CVE-2026-21582HIGHCVE-2026-21582EPSS 0.5%CVE-2026-21569HIGHCVE-2026-21569EPSS 0.3%