GHSA-VXXR-HXJ5-58VP高危未审查

无摘要

OSV 1.4.0 · unreviewed · 修改于 2026-08-19 08:31

发布时间

2026-08-19 08:31

GitHub 审查时间

—

NVD 发布时间

2026-08-19 06:16

源文件

advisories/unreviewed/2026/08/GHSA-vxxr-hxj5-58vp/GHSA-vxxr-hxj5-58vp.json

公告说明

This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center.

This BASM (Broken Authentication & Session Management) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perform actions as another user.

Atlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
	
	Crowd Data Center 7.2: Upgrade to a release greater than or equal to 7.2.2
	
	

See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center from the download center (https://www.atlassian.com/software/crowd/download-archive). 

This vulnerability was reported via our Penetration Testing program.

受影响的软件包

该公告没有提供结构化的受影响软件包信息。

参考链接

标识信息

别名 / CVE

CVE-2026-21582

CWE

CWE-287

软件生态

无

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

原始 OSV JSON

{
  "id": "GHSA-vxxr-hxj5-58vp",
  "aliases": [
    "CVE-2026-21582"
  ],
  "details": "This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center.\n\nThis BASM (Broken Authentication & Session Management) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perform actions as another user.\n\t\n\tAtlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\tCrowd Data Center 7.2: Upgrade to a release greater than or equal to 7.2.2\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center from the download center (https://www.atlassian.com/software/crowd/download-archive). \n\t\n\tThis vulnerability was reported via our Penetration Testing program.",
  "affected": [],
  "modified": "2026-08-19T00:31:10Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  ],
  "published": "2026-08-19T00:31:10Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21582",
      "type": "ADVISORY"
    },
    {
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999768",
      "type": "WEB"
    },
    {
      "url": "https://jira.atlassian.com/browse/CWD-6562",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "nvd_published_at": "2026-08-18T22:16:50Z",
    "github_reviewed_at": null
  }
}