CVE-2019-20902

Published: Oct 1, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.

Affected (2)

Products: Atlassian: Crowd

Atlassian

1 product

Crowd

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Atlassian Crowd	Before 3.4.6
Atlassian Crowd	From 3.5.0 to 3.5.1

References (2)

https://jira.atlassian.com/browse/CWD-5409

Source: security@atlassian.com

Vendor Advisory

https://jira.atlassian.com/browse/CWD-5409

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.