Critical · published June 3, 2019
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 This vulnerability lets attackers install any plugin they want on your Crowd or Crowd Data Center instance! 🔥 Think of it like a hotel maintenance worker who can check into any room, swap out the locks, and throw a wild party—without anyone checking their ID! 🏨 An attacker could run arbitrary code on your system, leading to unauthorized access and complete control over your data. This means sensitive information could be stolen, services disrupted, or even worse, your system could be turned into a launching pad for other attacks!
Think of it like a hotel maintenance worker who can check into any room, swap out the locks, and throw a wild party—without anyone checking their ID! 🏨 The pdkinstall development plugin is mistakenly enabled in release builds, allowing both unauthenticated and authenticated requests to exploit it and install malwares as plugins, leading to remote code execution.
An attacker could run arbitrary code on your system, leading to unauthorized access and complete control over your data. This means sensitive information could be stolen, services disrupted, or even worse, your system could be turned into a launching pad for other attacks! Immediate action is crucial: Update to Crowd versions 3.0.5, 3.1.6, 3.2.8, 3.3.5, or 3.4.4, depending on your current version. Ensure that the pdkinstall plugin is disabled in the production environment to prevent any unauthorized installations. 🔒 You’ve got this! Follow these steps, and you’ll be back in the safety zone in no time! 🛡️