CVE-2013-3926: High severity atlassian crowd vulnerability

Published Jul 1, 2013

Updated

DISPUTED Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, the vendor could not reproduce the issue, stating "We've been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued."

Affected Software

1 affected component

Atlassian crowd=2.6.3

Event History

Jul 1, 2013

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Disputed

09:55 PM

Frequently Asked Questions

What is the severity of CVE-2013-3926?

CVE-2013-3926 is considered disputed, as the vendor has been unable to reproduce the vulnerability.

How do I fix CVE-2013-3926?

Currently, there is no official patch or fix for CVE-2013-3926 as the existence of the vulnerability has not been substantiated.

What software is affected by CVE-2013-3926?

CVE-2013-3926 specifically affects version 2.6.3 of Atlassian Crowd.

Can CVE-2013-3926 allow for remote code execution?

CVE-2013-3926 has the potential to allow remote attackers to execute arbitrary commands due to an alleged backdoor.

Has Atlassian acknowledged CVE-2013-3926?

Atlassian has publicly stated that they were unable to substantiate the claims made by the CVE regarding a backdoor.