CVE-2019-20902 Business logic in Crowd

What is CVE-2019-20902?

CVE-2019-20902 is a high-severity vulnerability in Atlassian Crowd, published on 1 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.

Which versions are affected by CVE-2019-20902?

It affects 1 product.

Products include Atlassian Crowd.

How do I fix CVE-2019-20902?

No fix has been published for CVE-2019-20902 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-20902 being exploited?

There is no known exploitation of CVE-2019-20902 in the wild and no public exploit code.

Other vulnerabilities in Atlassian Crowd

• CVE-2019-11580 Atlassian Crowd and Crowd Data Center Remote Code Execution Exploited Critical 9.8
• CVE-2022-43782 Auth bypass in Crowd Data Center Critical 9.8
• CVE-2016-6496 Deserialization in n/a Critical 9.8
• CVE-2017-18105 Auth bypass in Crowd High 8.1
• CVE-2018-20238 Auth bypass in Crowd High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wx2c-gr4x-w2jg.