Crowd Security Notice 2013-07-01
On 30th of June 2013, an article was uploaded to Slashdot regarding two vulnerabilities in Atlassian Crowd. We had already identified and fixed the first vulnerability, which affects only standalone Crowd servers and which the author had labeled CVE-2013-3925. Patches and updated packages are available at https://jira.atlassian.com/browse/CWD-3366.
We have been unable to substantiate the existence of the second alleged vulnerability. The author of the article has not contacted Atlassian and has provided no details to us, making it difficult to validate the claim.
While we have been unable to confirm the existence of the second vulnerability, designated CVE-2013-3926, we are taking it seriously and have reached out to the author directly for more details. If we can confirm that there is a vulnerability, a patch will be issued and all Crowd customers will be emailed details on how to update.