Atlassian Crowd
24 CVEs affecting Atlassian Crowd. Latest disclosed: 2026-01-28. Critical: 5, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43782 | Critical | 9.8 | 2022-11-17 | Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call pr… |
CVE-2022-26136 | Critical | 9.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impa… |
CVE-2019-11580 | Critical | 9.8 | 2019-06-03 | Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or au… |
CVE-2016-6496 | Critical | 9.8 | 2016-12-09 | The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute wit… |
CVE-2012-2926 | Critical | 9.1 | 2012-05-22 | Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 be… |
CVE-2023-22521 | High | 8.8 | 2023-11-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Executio… |
CVE-2022-26137 | High | 8.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application… |
CVE-2017-18105 | High | 8.1 | 2019-03-29 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obt… |
CVE-2018-20238 | High | 8.1 | 2019-02-13 | Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expi… |
CVE-2026-21569 | High | 7.9 | 2026-01-28 | This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML Externa… |
CVE-2019-20902 | High | 7.5 | 2020-10-01 | Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3… |
CVE-2019-20104 | High | 7.5 | 2020-02-06 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Servi… |
CVE-2017-18106 | High | 7.5 | 2019-03-29 | The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in… |
CVE-2017-18108 | High | 7.2 | 2019-03-29 | The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary… |
CVE-2017-16858 | Medium | 6.8 | 2018-01-31 | The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker t… |
CVE-2017-18107 | Medium | 6.5 | 2019-12-17 | Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups… |
CVE-2017-18110 | Medium | 6.5 | 2019-03-29 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read… |
CVE-2017-18109 | Medium | 6.1 | 2019-03-29 | The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to… |
CVE-2018-20239 | Medium | 5.4 | 2019-04-30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version… |
CVE-2020-36240 | Medium | 5.3 | 2021-03-01 | The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbit… |