CVE-2022-43782

CVE-2022-43782 is a critical security misconfiguration vulnerability affecting Atlassian Crowd versions 3.x.x, 4.x.x prior to 4.4.4, and 5.x.x prior to 5.0.3. An unauthenticated attacker can exploit this to authenticate as the crowd application and call privileged REST API endpoints, leading to full compromise of confidentiality, integrity, and availability. While the vulnerability has a CVSS score of 9.8 (Critical), exploitation is limited to IPs on the crowd application allowlist, which is empty by default. There is no known active exploitation, public exploit code, or KEV listing, though it has received some community discussion and media coverage.