crowd[.]propertiesDomain
Reported by 6 independent sources · first reported by watchTowr Labs · last reported
Last reported 8 days ago
What the reports say
7 reports, newest first · the exact sentence from each-
U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog“In one Crowd deployment with Jira, researchers were able to read crowd[.]properties, which exposed application credentials.”
-
Critical Flaw in Multiple Atlassian Products Exploited in the Wild“For example, when Jira is configured to use Crowd, Jira's crowd[.]properties configuration file contains the credentials that Jira uses to communicate with Crowd.”
-
Atlassian Vulnerability Comes Under Attack Hours After Details Go Public“In one Crowd deployment with Jira, researchers were able to read crowd[.]properties, which exposed application credentials.”
-
Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)“They found that Atlassian Crowd deployments store crowd[.]properties under WEB-INF/classes, containing the application name and password in plaintext.”
-
CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products“In an Atlassian Crowd deployment that had Jira configured, reading WEB-INF/classes/crowd[.]properties exposed application credentials.”
-
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details“Importantly, in the case of Atlassian Crowd and Jira, the attacker could exploit the flaw to access "WEB-INF/classes/crowd[.]properties," which stores Crowd credentials, and then use them to gain administrative access to the application.”
-
You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)“The Crowd config file is located at WEB-INF/classes/crowd[.]properties.”
Indicators reported together
named in the same reports- router[.]javain 1 report
- resourcename[.]mapin 1 report
- hxxp://java.sun[.]com/xml/ns/javaeein 1 report
- hxxp://java.sun[.]com/xml/ns/javaee/web-app_3_0.xsdin 1 report
- hxxp://www.atlassian[.]com/software/jirain 1 report
- application[.]namein 1 report
- 38.60.157[.]86in 1 report
- 146.70.187[.]234in 1 report
- 159.26.119[.]225in 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2026-21589
Thanks — we review every report.