CVE-2016-6496 - Vulnerability Details - OpenCVE

The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Atlassian	Crowd

Configuration 1 [-]

OR	cpe:2.3:a:atlassian:crowd::::::::
	cpe:2.3:a:atlassian:crowd:2.9.0:::::::*
	cpe:2.3:a:atlassian:crowd:2.9.1:::::::*

No data.

References

Link	Providers
http://www.securityfocus.com/archive/1/539655/100/0/threaded
http://www.securityfocus.com/bid/93826
https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html
https://jira.atlassian.com/browse/CWD-4790
https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: hpe

Published: 2016-12-09T22:00:00

Updated: 2024-08-06T01:29:20.272Z

Reserved: 2016-08-01T00:00:00

Link: CVE-2016-6496

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-12-09T22:59:02.233

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-6496

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-10-19T00:00:00", "descriptions": [{"lang": "en", "value": "The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://jira.atlassian.com/browse/CWD-4790"}, {"name": "20161031 October 2016 - Crowd - Critical Security Advisory", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/539655/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html"}, {"name": "93826", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/93826"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-alert@hpe.com", "ID": "CVE-2016-6496", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://jira.atlassian.com/browse/CWD-4790", "refsource": "CONFIRM", "url": "https://jira.atlassian.com/browse/CWD-4790"}, {"name": "20161031 October 2016 - Crowd - Critical Security Advisory", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/539655/100/0/threaded"}, {"name": "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf", "refsource": "MISC", "url": "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf"}, {"name": "https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html", "refsource": "CONFIRM", "url": "https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html"}, {"name": "93826", "refsource": "BID", "url": "http://www.securityfocus.com/bid/93826"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:29:20.272Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://jira.atlassian.com/browse/CWD-4790"}, {"name": "20161031 October 2016 - Crowd - Critical Security Advisory", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/539655/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html"}, {"name": "93826", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/93826"}]}]}, "cveMetadata": {"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "assignerShortName": "hpe", "cveId": "CVE-2016-6496", "datePublished": "2016-12-09T22:00:00", "dateReserved": "2016-08-01T00:00:00", "dateUpdated": "2024-08-06T01:29:20.272Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FAD9482-A678-48B0-BD13-4816E5F6C633", "versionEndIncluding": "2.8.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:crowd:2.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "81B0955C-B68C-4EE5-9C95-D722CFF41038", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:crowd:2.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "759D841A-F266-4B05-9F7C-A2D4112A18F0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning."}, {"lang": "es", "value": "El conector de directorio LDAP en Atlassian Crowd en versiones anteriores a 2.8.8 y 2.9.x en versiones anteriores a 2.9.5 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un atributo LDAP con un objeto Java serializado manipulado, tambi\u00e9n conocido como envenenamiento de entrada LDAP."}], "id": "CVE-2016-6496", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-12-09T22:59:02.233", "references": [{"source": "security-alert@hpe.com", "url": "http://www.securityfocus.com/archive/1/539655/100/0/threaded"}, {"source": "security-alert@hpe.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/93826"}, {"source": "security-alert@hpe.com", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html"}, {"source": "security-alert@hpe.com", "tags": ["Issue Tracking"], "url": "https://jira.atlassian.com/browse/CWD-4790"}, {"source": "security-alert@hpe.com", "tags": ["Not Applicable"], "url": "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/539655/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/93826"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://jira.atlassian.com/browse/CWD-4790"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}