Lucene search
MitreCVE-2013-3925HistoryJul 01, 2013 - 9:55 p.m.
CVE-2013-3925
2013-07-0121:55:02
CWE-20
mitre
web.nvd.nist.gov
34
cve-2013-3925
atlassian crowd
remote attack
arbitrary files
http requests
security vulnerability
CVSS2
5.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
AI Score
8.9
Confidence
High
EPSS
0.003
Percentile
70.1%
Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.
Affected configurations
Node
atlassiancrowdMatch2.5.0
ORatlassiancrowdMatch2.5.1
ORatlassiancrowdMatch2.5.2
ORatlassiancrowdMatch2.5.3
Node
atlassiancrowdMatch2.6.0
ORatlassiancrowdMatch2.6.1
ORatlassiancrowdMatch2.6.2
Node
atlassiancrowdMatch2.3.8
ORatlassiancrowdMatch2.4.9
| Vendor | Product | Version | CPE |
|---|---|---|---|
| atlassian | crowd | 2.5.0 | cpe:2.3:a:atlassian:crowd:2.5.0:*:*:*:*:*:*:* |
| atlassian | crowd | 2.5.1 | cpe:2.3:a:atlassian:crowd:2.5.1:*:*:*:*:*:*:* |
| atlassian | crowd | 2.5.2 | cpe:2.3:a:atlassian:crowd:2.5.2:*:*:*:*:*:*:* |
| atlassian | crowd | 2.5.3 | cpe:2.3:a:atlassian:crowd:2.5.3:*:*:*:*:*:*:* |
| atlassian | crowd | 2.6.0 | cpe:2.3:a:atlassian:crowd:2.6.0:*:*:*:*:*:*:* |
| atlassian | crowd | 2.6.1 | cpe:2.3:a:atlassian:crowd:2.6.1:*:*:*:*:*:*:* |
| atlassian | crowd | 2.6.2 | cpe:2.3:a:atlassian:crowd:2.6.2:*:*:*:*:*:*:* |
| atlassian | crowd | 2.3.8 | cpe:2.3:a:atlassian:crowd:2.3.8:*:*:*:*:*:*:* |
| atlassian | crowd | 2.4.9 | cpe:2.3:a:atlassian:crowd:2.4.9:*:*:*:*:*:*:* |
Related
openvas
openvas
Atlassian Crowd Xml eXternal Entity (XXE) Injection Vulnerability
2013-07-09 00:00:00
Atlassian Crowd XXE Vulnerability (CWD-3366) - Active Check
2013-07-09 00:00:00
nvd
nvd
CVE-2013-3925
2013-07-01 21:55:02
nessus
nessus
prion
prion
Xxe
2013-07-01 21:55:00
cvelist
cvelist
CVE-2013-3925
2013-07-01 21:00:00
atlassian
atlassian
CVSS2
5.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
AI Score
8.9
Confidence
High
EPSS
0.003
Percentile
70.1%
Related for CVE-2013-3925