CVE-2013-3926 (GCVE-0-2013-3926)

Vulnerability from cvelistv5 – Published: 2013-07-01 21:00 – Updated: 2024-08-06 16:22 Disputed
VLAI
Summary
Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, the vendor could not reproduce the issue, stating "We've been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
Date Public
2013-06-30 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:22:01.632Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-06-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a \"symmetric backdoor.\"  NOTE: as of 20130704, the vendor could not reproduce the issue, stating \"We\u0027ve been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-07-09T09:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2013-3926",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED ** Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a \"symmetric backdoor.\"  NOTE: as of 20130704, the vendor could not reproduce the issue, stating \"We\u0027ve been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf",
              "refsource": "MISC",
              "url": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf"
            },
            {
              "name": "http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd",
              "refsource": "MISC",
              "url": "http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2013-3926",
    "datePublished": "2013-07-01T21:00:00.000Z",
    "dateReserved": "2013-06-04T00:00:00.000Z",
    "dateUpdated": "2024-08-06T16:22:01.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2013-3926",
      "date": "2026-06-04",
      "epss": "0.01027",
      "percentile": "0.77639"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2013-3926\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2013-07-01T21:55:03.090\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[{\"sourceIdentifier\":\"cve@mitre.org\",\"tags\":[\"disputed\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a \\\"symmetric backdoor.\\\"  NOTE: as of 20130704, the vendor could not reproduce the issue, stating \\\"We\u0027ve been unable to substantiate the existence of [CVE-2013-3926]. The author of the article has not contacted Atlassian and has provided no detail, making it difficult to validate the claim... If we can confirm that there is a vulnerability, a patch will be issued.\"},{\"lang\":\"es\",\"value\":\"** DISPUTADA ** Atlassian Crowd 2.6.3 permite a atacantes remotos ejecutar comandos arbitrarios a trav\u00e9s de vectores relacionados con una \u0027puerta trasera sim\u00e9trica.\u0027 NOTA: desde el 04072013, el proveedor no ha podido reproducir el problema, diciendo que \u0027No hemos sido capaces de corroborar la existencia del [CVE-2013-3926]. El autor del art\u00edculo no ha contactado Atlassian y no ha proporcionado ninguno detalle, haci\u00e9ndolo dif\u00edcil validar la afirmaci\u00f3n... Si podemos confirmar que exista una vulnerabilidad, se ofrecer\u00e1 un parche.\u0027\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:crowd:2.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D67A5A7-35C9-46F8-93CE-F627AC0AEF3E\"}]}]}],\"references\":[{\"url\":\"http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"URL Repurposed\"]},{\"url\":\"http://it.slashdot.org/story/13/07/01/0011217/backdoor-discovered-in-atlassian-crowd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"URL Repurposed\"]}],\"evaluatorComment\":\"Per: http://cwe.mitre.org/data/definitions/77.html\\n\\n\u0027CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\u0027\",\"vendorComments\":[{\"organization\":\"Atlassian\",\"comment\":\"On 30th of June 2013, an article was uploaded to Slashdot regarding\\ntwo vulnerabilities in Atlassian Crowd. We had already identified and\\nfixed the first vulnerability, which affects only standalone Crowd\\nservers and which the author had labeled CVE-2013-3925. Patches and\\nupdated packages are available at\\nhttps://jira.atlassian.com/browse/CWD-3366.\\n\\nWe have been unable to substantiate the existence of the second\\nalleged vulnerability. The author of the article has not contacted\\nAtlassian and has provided no details to us, making it difficult to\\nvalidate the claim.\\n\\nWhile we have been unable to confirm the existence of the second\\nvulnerability, designated CVE-2013-3926, we are taking it seriously\\nand have reached out to the author directly for more details. If we\\ncan confirm that there is a vulnerability, a patch will be issued and\\nall Crowd customers will be emailed details on how to update.\",\"lastModified\":\"2013-07-09T00:00:00\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.