« Volver al listado

CVE-2013-3925

Estado: ModificadaMedia (5.8)—

Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Atlassian — Crowd

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-3925",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-07-01T21:55:02.170",
  "references": [
    {
      "url": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://jira.atlassian.com/browse/CWD-3366",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.commandfive.com/papers/C5_TA_2013_3925_AtlassianCrowd.pdf",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.atlassian.com/browse/CWD-3366",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference."
    },
    {
      "lang": "es",
      "value": "Atlassian Crowd v2.5.x anterior a v2.5.4, v2.6.x anterior a v2.6.3, v2.3.8, y v2.4.9 permite a atacantes remotos leer archivos de su elección y el envío de peticiones HTTP a servidores de la intranet a través de una petición a (1) /services/2 o (2) services/latest con una DTD que contiene una declaración de entidad externa XML en conjunción con una referencia de entidad."
    }
  ],
  "lastModified": "2026-06-16T23:56:01.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99E8058A-FACB-41B7-982F-E97C513EB814"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13F2E20D-A958-4BA2-BD6A-C802B99CC57A"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D63E6CB9-266C-4348-AB2E-BDF568FA86D0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75DC949F-E218-4142-AAB5-AF932E9C93D6"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99582FB9-DE06-40F6-9E19-9EBF10DD8A47"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "479873F5-3B68-44E3-989B-E714E531ADF7"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE29ECF3-D6E8-43E4-94F8-C6564B1BAF9F"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.3.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DBE57E2-9F40-400A-B476-2D3243843489"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:2.4.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "851C6C41-5BB8-4C8F-B268-68DF6C808AB8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}