CVE-2013-3925 — Improper Input Validation in Atlassian Crowd

CWE-20 — Improper Input Validation3 documents3 sources
Severity
5.8MEDIUMNVD
EPSS
0.3%
top 42.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Atlassian Crowd
Timeline
PublishedJul 1
Latest updateMay 17

Description

Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages1 packages

▶NVDatlassian/crowd9 versions+8

🔴Vulnerability Details

2
GHSA
GHSA-w3j4-57m3-994j: Atlassian Crowd 2↗2022-05-17
▶
CVEList
CVE-2013-3925: Atlassian Crowd 2↗2013-07-01
▶
CVE-2013-3925 — Improper Input Validation in Atlassian | cvebase