Description (CNA)
The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Atlassian / Crowd | affected unspecified before 3.6.2; affected 3.7.0 before unspecified; affected unspecified before 3.7.1 |
CWE
No CWE identifiers supplied.
References
- https://jira.atlassian.com/browse/CWD-5526
- https://zeroauth.ltd/blog/2020/02/07/cve-2019-20104-atlassian-crowd-openid-client-vulnerable-to-remote-dos-via-xml-entity-expansion/
ADP enrichment
No English description supplied.