CVE-2013-3925 - Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference

Back Back to CVE browser

MEDIUM

Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference

Published Jul 1, 2013

5.8

MEDIUM

CVSS 2.0

EPSS 1.76%

Description

Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf
x_refsource_MISCExploitURL Repurposed
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-3857
Advisory
https://jira.atlassian.com/browse/CWD-3366
x_refsource_CONFIRM

Link	Providers	Tags
http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf		x_refsource_MISCExploitURL Repurposed
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-3857		Advisory
https://jira.atlassian.com/browse/CWD-3366		x_refsource_CONFIRM