Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-5526

XXE in OpenID client application - CVE-2019-20104

XMLWordPrintable

      The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd.

      Please be aware that the OpenID client application is a testing app used as a starting point for developing OpenID-enabled Java applications. It is bundled with the standard Crowd distribution and it was deployed by default prior to Crowd Version 3.6.2. Moreover it runs in the same Tomcat container as the Crowd and OpenID Server. However, this application is not required for Crowd or OpenID server to work correctly. Regarding this security vulnerability, the OpenID client application has been disabled by default since Crowd version 3.6.2. If you are running older version of Crowd, and at the moment you are unable to update Crowd, then you can disable the Crowd OpenID client application manually by executing the procedure found here.

            [CWD-5526] XXE in OpenID client application - CVE-2019-20104

            Security Metrics Bot added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment.
            CVSS v3 score: 5.3 => Medium severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required None
            User Interaction None

            Scope Metric

            Scope Unchanged

            Impact Metrics

            Confidentiality None
            Integrity None
            Availability Low

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

            Security Metrics Bot added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 5.3 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality None Integrity None Availability Low https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: