Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-5526

XXE in OpenID client application - CVE-2019-20104

XMLWordPrintable

      The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd.

      Please be aware that the OpenID client application is a testing app used as a starting point for developing OpenID-enabled Java applications. It is bundled with the standard Crowd distribution and it was deployed by default prior to Crowd Version 3.6.2. Moreover it runs in the same Tomcat container as the Crowd and OpenID Server. However, this application is not required for Crowd or OpenID server to work correctly. Regarding this security vulnerability, the OpenID client application has been disabled by default since Crowd version 3.6.2. If you are running older version of Crowd, and at the moment you are unable to update Crowd, then you can disable the Crowd OpenID client application manually by executing the procedure found here.

            [CWD-5526] XXE in OpenID client application - CVE-2019-20104

            Cathy S made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 489829 ]
            David Black made changes -
            Summary Original: XXE in OpenID client - CVE-2019-20104 New: XXE in OpenID client application - CVE-2019-20104
            David Black made changes -
            Description Original: The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd.

            Please be aware that the OpenID client application is a testing app used as a starting point for developing OpenID-enabled Java applications. It is bundled with the standard Crowd distribution and it was deployed by default prior to Crowd Version 3.6.2. Moreover it runs in the same Tomcat container as the Crowd and OpenID Server. However, this application is not required for Crowd or OpenID server to work correctly. Regarding this security vulnerability, the OpenID client application has been disabled by default since Crowd version 3.6.2. If you are running older version of Crowd, and at the moment you are unable to update Crowd, then you can disable this app manually by executing the procedure found [here|https://confluence.atlassian.com/crowd/disabling-the-openid-client-app-986879764.html].
            		New: The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd.

            Please be aware that the OpenID client application is a testing app used as a starting point for developing OpenID-enabled Java applications. It is bundled with the standard Crowd distribution and it was deployed by default prior to Crowd Version 3.6.2. Moreover it runs in the same Tomcat container as the Crowd and OpenID Server. However, this application is not required for Crowd or OpenID server to work correctly. Regarding this security vulnerability, the OpenID client application has been disabled by default since Crowd version 3.6.2. If you are running older version of Crowd, and at the moment you are unable to update Crowd, then you can disable the Crowd OpenID client application manually by executing the procedure found [here|https://confluence.atlassian.com/crowd/disabling-the-openid-client-app-986879764.html].
            David Black made changes -
            Description Original: The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd.

            Please be aware that the OpenID client application is a testing app used as a starting point for developing OpenID-enabled Java applications. It is bundled with the standard Crowd distribution and it is deployed by default. Moreover it runs in the same Tomcat container as the Crowd and OpenID Server. However, this application is not required for Crowd or OpenID server to work correctly. Regarding this security vulnerability, the OpenID client application has been disabled by default since Crowd version 3.6.2. If you are running older version of Crowd, and at the moment you are unable to update Crowd, then you can disable this app manually by executing the procedure found [here|https://confluence.atlassian.com/crowd/disabling-the-openid-client-app-986879764.html].
            		New: The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd.

            Please be aware that the OpenID client application is a testing app used as a starting point for developing OpenID-enabled Java applications. It is bundled with the standard Crowd distribution and it was deployed by default prior to Crowd Version 3.6.2. Moreover it runs in the same Tomcat container as the Crowd and OpenID Server. However, this application is not required for Crowd or OpenID server to work correctly. Regarding this security vulnerability, the OpenID client application has been disabled by default since Crowd version 3.6.2. If you are running older version of Crowd, and at the moment you are unable to update Crowd, then you can disable this app manually by executing the procedure found [here|https://confluence.atlassian.com/crowd/disabling-the-openid-client-app-986879764.html].
            David Black made changes -
            Description Original: The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
            		New: The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd.

            Please be aware that the OpenID client application is a testing app used as a starting point for developing OpenID-enabled Java applications. It is bundled with the standard Crowd distribution and it is deployed by default. Moreover it runs in the same Tomcat container as the Crowd and OpenID Server. However, this application is not required for Crowd or OpenID server to work correctly. Regarding this security vulnerability, the OpenID client application has been disabled by default since Crowd version 3.6.2. If you are running older version of Crowd, and at the moment you are unable to update Crowd, then you can disable this app manually by executing the procedure found [here|https://confluence.atlassian.com/crowd/disabling-the-openid-client-app-986879764.html].
            David Black made changes -
            Labels Original: CVE-2019-20104 advisory advisory-to-release bugbounty cvss-medium injection security xxe New: CVE-2019-20104 advisory advisory-released bugbounty cvss-medium injection security xxe
            David Black made changes -
            Security Original: Atlassian Staff [ 10750 ]
            David Black made changes -
            Description Original: OpenID in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
            		New: The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
            David Black made changes -
            Description Original: OpenID in Atlassian Crowd from version 3.7.0 before version 3.6.2, before version 3.7.1 and before version 4.0.0 allows remote attackers to perform a Denial of Service attack via a XML Entity Expansion. New: OpenID in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
            flozza (Inactive) made changes -
            Description Original: Component in Atlassian Crowd from version 3.7.0 before version 3.6.2, before version 3.7.1 and before version 4.0.0 allows remote attackers to perform a Denial of Service attack via a XML Entity Expansion within the OpenID client. New: OpenID in Atlassian Crowd from version 3.7.0 before version 3.6.2, before version 3.7.1 and before version 4.0.0 allows remote attackers to perform a Denial of Service attack via a XML Entity Expansion.

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: