CVE-2013-3925

2013-07-0121:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2013-3925

atlassian crowd

remote attack

arbitrary files

http requests

security vulnerability

9 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.003 Low

EPSS

Percentile

69.3%

JSON

Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.

CPENameOperatorVersion
atlassian:crowdatlassian crowdeq2.5.2
atlassian:crowdatlassian crowdeq2.5.1
atlassian:crowdatlassian crowdeq2.5.3
atlassian:crowdatlassian crowdeq2.5.0
atlassian:crowdatlassian crowdeq2.6.0
atlassian:crowdatlassian crowdeq2.6.1
atlassian:crowdatlassian crowdeq2.6.2
atlassian:crowdatlassian crowdeq2.4.9
atlassian:crowdatlassian crowdeq2.3.8

CPE	Name	Operator	Version
atlassian:crowd	atlassian crowd	eq	2.5.2
atlassian:crowd	atlassian crowd	eq	2.5.1
atlassian:crowd	atlassian crowd	eq	2.5.3
atlassian:crowd	atlassian crowd	eq	2.5.0
atlassian:crowd	atlassian crowd	eq	2.6.0
atlassian:crowd	atlassian crowd	eq	2.6.1
atlassian:crowd	atlassian crowd	eq	2.6.2
atlassian:crowd	atlassian crowd	eq	2.4.9
atlassian:crowd	atlassian crowd	eq	2.3.8