PT-2020-10865

CVE-2019-20902

Published

2020-10-01

Updated

2020-10-14

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Crowd versions prior to 3.4.6 Crowd versions 3.5.0 through 3.5.0

Description Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP.

Recommendations For versions prior to 3.4.6, update to version 3.4.6 or later. For version 3.5.0, update to version 3.5.1 or later.

Exploitability

Fix

Researchers

Vendors

Affected products

Related identifiers

Found an issue in the description? Have something to add? Feel free to write us 👾