CyberSec.Space Logo
返回 CVE 浏览器

CVE-2016-6496

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0210%
EPSS Percentile15.40th
Published2016年12月9日
Last Modified2026年5月6日

Vulnerability Description

The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning.

Affected Platforms (CPE)

📦
Atlassian

Crowd

<= 2.8.4
📦
Atlassian

Crowd

= 2.9.0
📦
Atlassian

Crowd

= 2.9.1

References & Advisories

🔗 http://www.securityfocus.com/archive/1/539655/100/0/threaded
🔗 http://www.securityfocus.com/bid/93826
🔗 https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html
🔗 https://jira.atlassian.com/browse/CWD-4790
🔗 https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
🔗 http://www.securityfocus.com/archive/1/539655/100/0/threaded
🔗 http://www.securityfocus.com/bid/93826
🔗 https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html

相关漏洞威胁

CVE-2019-115809.8

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who c...

CVE-2012-29269.1

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8,...

CVE-2018-202388.1

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers ...

CVE-2017-181058.1

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attac...