medium5.8
CVE-2013-3925
Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet ser…
Impact
Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Atlassian | Crowd | Versions 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1 |