Test ID:	1.3.6.1.4.1.25623.1.0.106375
Category:	Web application abuses
Title:	Atlassian Crowd LDAP Java Object Injection Vulnerability (CWD-4790)
Summary:	Atlassian Crowd is prone to a LDAP Java object injection; vulnerability.
Description:	Summary: Atlassian Crowd is prone to a LDAP Java object injection vulnerability. Vulnerability Insight: The Crowd LDAP directory connector allowed an attacker to gain remote code execution in Crowd by injecting malicious attributes in LDAP entries. To exploit this issue, attackers need to modify an entry in your LDAP directory or successfully execute a Man-in-The-Middle attack between an LDAP server and Crowd. Crowd installations configured to communicate with an LDAP server using the LDAPS protocol with the Secure SSL option enabled are immune to this attack vector only (unless an attacker is able to obtain the private key of the SSL/TLS certificate used to secure the communication). Affected Software/OS: Atlassian Crowd version 1.4.1 through 2.8.7 and 2.9.x through 2.9.4. Solution: Update to version 2.8.8, 2.9.5 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6496 BugTraq ID: 93826 http://www.securityfocus.com/bid/93826 Bugtraq: 20161031 October 2016 - Crowd - Critical Security Advisory (Google Search) http://www.securityfocus.com/archive/1/539655/100/0/threaded https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.