High We have identified and fixed a vulnerability in Crowd that results from the way XML parsers are used. This vulnerability allows an attacker to:
- Execute denial of service attacks against the Crowd server, or
- Read all local files readable to the system user under which Crowd runs.
All versions of Crowd up to and including 2.4.0 are affected by this vulnerability.
Full details of the severity, risks and vulnerability can be found in the Crowd Security Advisory 2012-05-17.
![[Atlassian Documentation] Page](https://confluence.atlassian.com/images/icons/favicon.png "[Atlassian Documentation] Page"){kind=icon}
| Form Name | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
[CWD-2797] XML Vulnerability in Crowd
Patches for the most recent point release of the current and previous version are here:
To install the patch, navigate to the atlassian-crowd-x.x.x (where x.x.x is the Crowd version) directory and unzip the patch file.
Note, the patches are only available for the point release indicated. If you are using an earlier point release for a major version, you must upgrade to the latest point release first.