CVE-2019-20902

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.

Score

CVSS 3.1 7.5 High

Status

Modified - security@atlassian.com

Published

2020-10-01

Last modified

2024-09-17

Affected products

• Crowd (Atlassian)

References

• https://jira.atlassian.com/browse/CWD-5409