Read the docs
TI-2023-08760 Aliases CVE-2023-22521GHSA-m6fg-m377-682m

This High severity RCE (Remote Code Execution) vulnerability was introduced in version…

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Crowd Data Center and Server 3.4: Upgrade to a release greater than or equal to 5.1.6 Crowd Data Center and Server 5.2: Upgrade to a release greater than or equal to 5.2.1 See the release notes ([https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html]). You can download the latest version of Crowd Data Center and Server from the download center ([https://www.atlassian.com/software/crowd/download-archive]). This vulnerability was discovered by m1sn0w and reported via our Bug Bounty program

Why it matters now

EPSS 0.01213 68th percentileScored 2026-11-07
Fix Fixed Crowd Data Center (Atlassian): < 3.4.6, >= 5.1.6, >= 5.2.1Crowd Server (Atlassian): < 3.4.6, >= 5.1.6, >= 5.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianCrowd Data Center>= 3.4.6; >= 5.2.0< 3.4.6, >= 5.1.6, >= 5.2.1Patch availableCNA
AtlassianCrowd Server>= 3.4.6; >= 5.2.0< 3.4.6, >= 5.1.6, >= 5.2.1Patch availableCNA
  • Crowd Data Center VendorAtlassian Affected >= 3.4.6; >= 5.2.0 Fixed in < 3.4.6, >= 5.1.6, >= 5.2.1 Patch available CNA
  • Crowd Server VendorAtlassian Affected >= 3.4.6; >= 5.2.0 Fixed in < 3.4.6, >= 5.1.6, >= 5.2.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*3.4.0 to before 5.1.6VulnerableAtlassian
cpe:2.3:a:atlassian:crowd:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions 3.4.0 to before 5.1.6 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crowd:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Crowd Data Center (Atlassian) Fixed in < 3.4.6, >= 5.1.6, >= 5.2.1
  • Fix · CNA Crowd Server (Atlassian) Fixed in < 3.4.6, >= 5.1.6, >= 5.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22521
  2. 2026-10-03 Alias added: GHSA-m6fg-m377-682m

References

Advisory 2

  • TI-2019-08653 Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
  • TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
  • TI-2022-21516 Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd… CVSS 3.1CRITICAL 9.8
  • TI-2016-05568 The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5… CVSS 3.0CRITICAL 9.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences