Crowd vulnerabilities | LiveThreat CVE Feed

Product

Crowd

by Atlassian · last CVE Oct 5, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities25 In the news8 Timeline

Severity mix

Critical 5High 10Medium 8Low 0

Severity

All severities25 Critical5 High10 Medium8 Low0

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add Crowd to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2017-16858	6.8	1%	Jan 31	The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a… Affected: 1.5.0 before 3.1.2
CVE-2017-18107	6.5	0%	Dec 17	Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site… Affected: before 3.1.1
CVE-2017-18110	6.5	1%	Mar 29	The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the… Affected: before 3.0.2; 3.1.0
CVE-2017-18109	6.1	1%	Mar 29	The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website… Affected: before 3.0.2; 3.1.0
CVE-2018-20239	5.4	3%	Apr 30	Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 3.4.3
CVE-2020-36240	5.3	1%	Mar 1	The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within… Affected: before 4.0.4; 4.1.0 before 4.1.2
CVE-2016-10740	4.9	1%	Jan 29	Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the… Affected: before 2.10.1
CVE-2019-15005	4.3	1%	Nov 8	The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified… Affected: before 3.6.0