'Backdoor' reported in Atlassian Crowd

Update: A security research firm has claimed to have discovered a critical vulnerability in Atlassian Crowd which could allow enterprises to be compromised.

The alleged hole, which Atlassian downplayed, was described as a backdoor in the Crowd server database which would allow remote attackers to compromise corporate networks operating single sign on.

Atlassian has more than 25,000 customers including blue chip organisations.

Research firm Command Five said the undisclosed zero day hole (CVE 2013-3925) was similar to a patched bug (CVE 2012-2926) and could allow complete system hijacking.

"The vulnerability is remotely accessible, does not require authentication, and is easily exploited," the research firm said, awarding the bug a CVSS score of 9.4 out of 10. (pdf)

The firm did not yet report details of the patched flaw to the company, Atlassian said.

"The issue that [the] report actually describes is not a 'backdoor' and has limited impact",  an Atlassian Reddit post stated.

Atlassian directed some users inquiring about the flaw to a patch which would resolve the disclosed bug.

It posted a statement saying the author did not contact Atlassian nor supply vulnerability information. As a result it said it could not validate the disclosure.

Copyright © SC Magazine, Australia