XML Vulnerability in Crowd

2012-03-26T06:55:59
ID ATLASSIAN:CWD-2797
Type atlassian
Reporter jwalton
Modified 2019-08-15T07:05:56

Description

We have identified and fixed a vulnerability in Crowd that results from the way XML parsers are used. This vulnerability allows an attacker to:

  • Execute denial of service attacks against the Crowd server, or
  • Read all local files readable to the system user under which Crowd runs.

All versions of Crowd up to and including 2.4.0 are affected by this vulnerability.

Full details of the severity, risks and vulnerability can be found in the [Crowd Security Advisory 2012-05-17|http://confluence.atlassian.com/display/CROWD/Crowd+Security+Advisory+2012-05-17].