Vulnerabilities > CVE-2013-3926 - Unspecified vulnerability in Atlassian Crowd 2.6.3
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, the vendor could not reproduce the issue, stating "We've been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Statements
| contributor | |
| lastmodified | 2013-07-09 |
| organization | Atlassian |
| statement | On 30th of June 2013, an article was uploaded to Slashdot regarding two vulnerabilities in Atlassian Crowd. We had already identified and fixed the first vulnerability, which affects only standalone Crowd servers and which the author had labeled CVE-2013-3925. Patches and updated packages are available at https://jira.atlassian.com/browse/CWD-3366. We have been unable to substantiate the existence of the second alleged vulnerability. The author of the article has not contacted Atlassian and has provided no details to us, making it difficult to validate the claim. While we have been unable to confirm the existence of the second vulnerability, designated CVE-2013-3926, we are taking it seriously and have reached out to the author directly for more details. If we can confirm that there is a vulnerability, a patch will be issued and all Crowd customers will be emailed details on how to update. |