CVE-2022-43782
CVE-2022-43782 is a critical-severity vulnerability in Atlassian Crowd with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- EPSS exploit prediction: 1% (55th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Atlassian Crowd
- Published:
- Last modified:
Description
Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3
Frequently asked questions
- What is CVE-2022-43782?
- Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3
- How severe is CVE-2022-43782?
- CVE-2022-43782 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2022-43782 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-43782?
- CVE-2022-43782 affects Atlassian Crowd. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-43782?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2022-43782 published?
- CVE-2022-43782 was published on 2022-11-17 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*
More vulnerabilities in Atlassian Crowd
- CVE-2022-26136 — Critical (CVSS 9.8): A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used…
- CVE-2019-11580 — Critical (CVSS 9.8): Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds.…
- CVE-2016-6496 — Critical (CVSS 9.8): The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute…
- CVE-2012-2926 — Critical (CVSS 9.1): Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible…
- CVE-2023-22521 — High (CVSS 8.8): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and…
- CVE-2022-26137 — High (CVSS 8.8): A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet…