CVE-2013-3925

Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet…

published July 1, 2013

CVSS
—
EPSS
2%
Percentile
77.8
In the wild
Unconfirmed
What it is

Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01758 · 77.8th percentile
Published
2013-07-01T21:00Z
EPSS history
Timeline
  • 01 JUL 21:00Z
    Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet…
    cvelistv5