CVE-2019-20104 The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vul...
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian crowd | < 3.2.11 | 3.2.11 |
| atlassian crowd | >= 3.3.0, < 3.3.8 | 3.3.8 |
| atlassian crowd | >= 3.4.0, < 3.4.7 | 3.4.7 |
| atlassian crowd | >= 3.5.0, < 3.5.2 | 3.5.2 |
| atlassian crowd | >= 3.6.0, < 3.6.2 | 3.6.2 |
| atlassian crowd | >= 3.6.3, < 3.7.1 | 3.7.1 |
| atlassian crowd | >= 3.7.2, < 4.0.0 | 4.0.0 |
| atlassian crowd | < 3.6.2 | 3.6.2 |
| atlassian crowd | >= 3.7.0 | No fix listed |
| atlassian crowd | < 3.7.1 | 3.7.1 |
References
- jira.atlassian.com vendor-advisory
- zeroauth.ltd exploit technical-description