CVE-2019-20902

Description

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.

Affected products

• Atlassian / Crowdunspecified – 3.4.6
• Atlassian / Crowd3.5.0 – unspecified
• Atlassian / Crowdunspecified – 3.5.1

References

• MISChttps://jira.atlassian.com/browse/CWD-5409