XML Vulnerability in Crowd

We have identified and fixed a vulnerability in Crowd that results from the way XML parsers are used. This vulnerability allows an attacker to:

• Execute denial of service attacks against the Crowd server, or
• Read all local files readable to the system user under which Crowd runs.

All versions of Crowd up to and including 2.4.0 are affected by this vulnerability.

Full details of the severity, risks and vulnerability can be found in the Crowd Security Advisory 2012-05-17.