CVE-2019-20104
N/A
N/A
Summary
The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Atlassian | Crowd | unspecified < 3.6.2 | affected |
| Atlassian | Crowd | 3.7.0 < unspecified | affected |
| Atlassian | Crowd | unspecified < 3.7.1 | affected |
Weaknesses
- Improper Restriction of XML External Entity Reference
ADP Enrichment
CVE Program Container
Additional References
- https://jira.atlassian.com/browse/CWD-5526
- https://zeroauth.ltd/blog/2020/02/07/cve-2019-20104-atlassian-crowd-openid-client-vulnerable-to-remote-dos-via-xml-entity-expansion/
References
- https://jira.atlassian.com/browse/CWD-5526
- https://zeroauth.ltd/blog/2020/02/07/cve-2019-20104-atlassian-crowd-openid-client-vulnerable-to-remote-dos-via-xml-entity-expansion/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.