Read the docs
TI-2022-21516 Aliases CVE-2022-43782GHSA-j835-6ff4-p3mc

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd…

Priority MEDIUM 51Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00965 61st percentileScored 2026-11-07
Fix Fixed Crowd Data Center (Atlassian): before 3.0.0, 4.4.4, 5.0.3Crowd Server (Atlassian): before 3.0.0, 4.4.4, 5.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianCrowd Data Centerbefore 4.4.4; before 5.0.3before 3.0.0, 4.4.4, 5.0.3Patch availableCNA
AtlassianCrowd Serverbefore 4.4.4; before 5.0.3before 3.0.0, 4.4.4, 5.0.3Patch availableCNA
  • Crowd Data Center VendorAtlassian Affected before 4.4.4; before 5.0.3 Fixed in before 3.0.0, 4.4.4, 5.0.3 Patch available CNA
  • Crowd Server VendorAtlassian Affected before 4.4.4; before 5.0.3 Fixed in before 3.0.0, 4.4.4, 5.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*3.0.0 to before 4.4.4; 5.0.0 to before 5.0.3VulnerableAtlassian
  • cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions 3.0.0 to before 4.4.4; 5.0.0 to before 5.0.3 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Crowd Data Center (Atlassian) Fixed in before 3.0.0, 4.4.4, 5.0.3
  • Fix · CNA Crowd Server (Atlassian) Fixed in before 3.0.0, 4.4.4, 5.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43782
  2. 2026-10-03 Alias added: GHSA-j835-6ff4-p3mc

References

Patch 1

  • TI-2019-08653 Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
  • TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
  • TI-2016-05568 The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5… CVSS 3.0CRITICAL 9.8
  • TI-2022-09599 Origin validation error in Atlassian Bamboo Server CVSS 3.1HIGH 8.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences