Uploaded image for project: 'Crowd'
  1. Crowd
  2. CWD-5526

XXE in OpenID client application - CVE-2019-20104

    XMLWordPrintable

    Details

      Description

      The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd.

      Please be aware that the OpenID client application is a testing app used as a starting point for developing OpenID-enabled Java applications. It is bundled with the standard Crowd distribution and it was deployed by default prior to Crowd Version 3.6.2. Moreover it runs in the same Tomcat container as the Crowd and OpenID Server. However, this application is not required for Crowd or OpenID server to work correctly. Regarding this security vulnerability, the OpenID client application has been disabled by default since Crowd version 3.6.2. If you are running older version of Crowd, and at the moment you are unable to update Crowd, then you can disable the Crowd OpenID client application manually by executing the procedure found here.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: