← Back

CVE-2019-20104

nvd nist
Published: Feb 6, 2020Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.

Affected (7)

Products: Atlassian: Crowd
Atlassian
1 product
Crowd
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Atlassian
Crowd
Before 3.2.11
Crowd
From 3.3.0 to 3.3.8
Crowd
From 3.4.0 to 3.4.7
Crowd
From 3.5.0 to 3.5.2
Crowd
From 3.6.0 to 3.6.2
Crowd
From 3.6.3 to 3.7.1
Crowd
From 3.7.2 to 4.0.0

Related CWEs

CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (4)

Source: security@atlassian.com
Vendor Advisory
Source: security@atlassian.com
ExploitTechnical Description
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitTechnical Description

Timeline

No history available yet.