'Backdoor' found in Atlassian Crowd

By

Company claims 'limited impact'.

A security research firm claims to have discovered a critical vulnerability in Atlassian Crowd which could allow enterprises to be compromised.

'Backdoor' found in Atlassian Crowd

The alleged hole, which Atlassian downplayed, was described as a backdoor in the Crowd server database which would allow remote attackers to compromise corporate networks operating single sign on.

Atlassian has more than 25,000 customers including blue chip organisations.

Research firm Command Five said the undisclosed zero day hole (CVE 2013-3925) was similar to a patched bug (CVE 2012-2926) and could allow complete system hijacking.

"The vulnerability is remotely accessible, does not require authentication, and is easily exploited," the research firm said, awarding the bug a CVSS score of 9.4 out of 10. (pdf)

The firm had not yet reported details of the patched flaw to the company, Atlassian said.

"The issue that [the] report actually describes is not a 'backdoor' and has limited impact," an Atlassian Reddit post stated.

Atlassian directed some users inquiring about the flaw to a patch which would resolve the disclosed bug.

It posted a statement on its Facebook page saying the author did not contact Atlassian nor supply vulnerability information, and therefore could not validate the disclosure.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

Log In

  |  Forgot your password?