cve-2013-3926
Vulnerability from cvelistv5
Published
2013-07-01 21:00
Modified
2024-08-06 16:22
Severity ?
Summary
Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, the vendor could not reproduce the issue, stating "We've been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued.
References
cve@mitre.orghttp://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd
cve@mitre.orghttp://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdfExploit, URL Repurposed
af854a3a-2127-422b-91ae-364da2661108http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd
af854a3a-2127-422b-91ae-364da2661108http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdfExploit, URL Repurposed
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:22:01.632Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-06-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a \"symmetric backdoor.\"  NOTE: as of 20130704, the vendor could not reproduce the issue, stating \"We\u0027ve been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-07-09T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2013-3926",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED ** Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a \"symmetric backdoor.\"  NOTE: as of 20130704, the vendor could not reproduce the issue, stating \"We\u0027ve been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf",
              "refsource": "MISC",
              "url": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf"
            },
            {
              "name": "http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd",
              "refsource": "MISC",
              "url": "http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2013-3926",
    "datePublished": "2013-07-01T21:00:00",
    "dateReserved": "2013-06-04T00:00:00",
    "dateUpdated": "2024-08-06T16:22:01.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2013-3926\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2013-07-01T21:55:03.090\",\"lastModified\":\"2024-11-21T01:54:33.157\",\"vulnStatus\":\"Modified\",\"cveTags\":[{\"sourceIdentifier\":\"cve@mitre.org\",\"tags\":[\"disputed\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a \\\"symmetric backdoor.\\\"  NOTE: as of 20130704, the vendor could not reproduce the issue, stating \\\"We\u0027ve been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued.\"},{\"lang\":\"es\",\"value\":\"** DISPUTADA ** Atlassian Crowd 2.6.3 permite a atacantes remotos ejecutar comandos arbitrarios a trav\u00e9s de vectores relacionados con una \u0027puerta trasera sim\u00e9trica.\u0027 NOTA: desde el 04072013, el proveedor no ha podido reproducir el problema, diciendo que \u0027No hemos sido capaces de corroborar la existencia del [CVE-2013-3926]. El autor del art\u00edculo no ha contactado Atlassian y no ha proporcionado ninguno detalle, haci\u00e9ndolo dif\u00edcil validar la afirmaci\u00f3n... Si podemos confirmar que exista una vulnerabilidad, se ofrecer\u00e1 un parche.\u0027\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:crowd:2.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D67A5A7-35C9-46F8-93CE-F627AC0AEF3E\"}]}]}],\"references\":[{\"url\":\"http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"URL Repurposed\"]},{\"url\":\"http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"URL Repurposed\"]}],\"evaluatorComment\":\"Per: http://cwe.mitre.org/data/definitions/77.html\\n\\n\u0027CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\u0027\",\"vendorComments\":[{\"organization\":\"Atlassian\",\"comment\":\"On 30th of June 2013, an article was uploaded to Slashdot regarding\\ntwo vulnerabilities in Atlassian Crowd. We had already identified and\\nfixed the first vulnerability, which affects only standalone Crowd\\nservers and which the author had labeled CVE-2013-3925. Patches and\\nupdated packages are available at\\nhttps://jira.atlassian.com/browse/CWD-3366.\\n\\nWe have been unable to substantiate the existence of the second\\nalleged vulnerability. The author of the article has not contacted\\nAtlassian and has provided no details to us, making it difficult to\\nvalidate the claim.\\n\\nWhile we have been unable to confirm the existence of the second\\nvulnerability, designated CVE-2013-3926, we are taking it seriously\\nand have reached out to the author directly for more details. If we\\ncan confirm that there is a vulnerability, a patch will be issued and\\nall Crowd customers will be emailed details on how to update.\",\"lastModified\":\"2013-07-09T00:00:00\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.