CVE-2013-3925: Input Validation

Published Jul 1, 2013

Updated

Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.

Affected Software

9 affected components

Atlassian crowd=2.5.0

Atlassian crowd=2.5.1

Atlassian crowd=2.5.2

Atlassian crowd=2.5.3

Atlassian crowd=2.6.0

Atlassian crowd=2.6.1

Atlassian crowd=2.6.2

Atlassian crowd=2.3.8

Atlassian crowd=2.4.9

Event History

Jul 1, 2013

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3925?

CVE-2013-3925 has a severity rating of medium, as it allows remote attackers to read arbitrary files and send unauthorized HTTP requests.

How do I fix CVE-2013-3925?

To fix CVE-2013-3925, upgrade Atlassian Crowd to version 2.5.4 or later, or version 2.6.3 or later.

Which versions of Atlassian Crowd are affected by CVE-2013-3925?

CVE-2013-3925 affects Atlassian Crowd versions 2.5.0 to 2.5.3, 2.6.0 to 2.6.2, as well as versions 2.3.8 and 2.4.9.

Can CVE-2013-3925 be exploited without authentication?

Yes, CVE-2013-3925 can be exploited by remote attackers without requiring authentication.

What type of vulnerability is CVE-2013-3925?

CVE-2013-3925 is classified as an XML External Entity (XXE) vulnerability.