CVE-2019-11580 Atlassian Crowd and Crowd Data Center Remote Code Execution
Attackers can install arbitrary plugins via an exposed development plugin, leading to remote code execution on Atlassian Crowd instances.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11580?
CVE-2019-11580 is a critical missing authorization vulnerability in Atlassian Crowd, published on 3 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
Which versions are affected by CVE-2019-11580?
It affects 1 product.
Products include Atlassian Crowd.
How do I fix CVE-2019-11580?
No fix has been published for CVE-2019-11580 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-11580 being exploited?
Yes. Attackers have exploited CVE-2019-11580 in the wild since at least 3 Nov 2021, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Atlassian Crowd
Sources
Also known as GHSA-8977-4jwc-24g8.