'Backdoor' reported in Atlassian Crowd

By

'Backdoor' label refuted.

Update: A security research firm has claimed to have discovered a critical vulnerability in Atlassian Crowd which could allow enterprises to be compromised.

'Backdoor' reported in Atlassian Crowd

The alleged hole, which Atlassian downplayed, was described as a backdoor in the Crowd server database which would allow remote attackers to compromise corporate networks operating single sign on.

Atlassian has more than 25,000 customers including blue chip organisations.

Research firm Command Five said the undisclosed zero day hole (CVE 2013-3925) was similar to a patched bug (CVE 2012-2926) and could allow complete system hijacking.

"The vulnerability is remotely accessible, does not require authentication, and is easily exploited," the research firm said, awarding the bug a CVSS score of 9.4 out of 10. (pdf)

The firm did not yet report details of the patched flaw to the company, Atlassian said.

"The issue that [the] report actually describes is not a 'backdoor' and has limited impact",  an Atlassian Reddit post stated.

Atlassian directed some users inquiring about the flaw to a patch which would resolve the disclosed bug.

It posted a statement saying the author did not contact Atlassian nor supply vulnerability information. As a result it said it could not validate the disclosure.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

NSW Police to embark on $126m IT overhaul

NSW Police to embark on $126m IT overhaul

CBA looks to GenAI to assist 1200 'security champions'

CBA looks to GenAI to assist 1200 'security champions'

Victoria's first government tech chief steps down

Victoria's first government tech chief steps down

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Log In

  |  Forgot your password?