Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest with a DTD containing an XML external entity declaration in conjunction with an entity reference.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Atlassian Crowd 任意文件读取漏洞
Vulnerability Description
Atlassian Crowd是澳大利亚Atlassian公司的一套基于Web的单点登录系统。该系统为多用户、网络应用程序和目录服务器提供验证、授权等功能。 Atlassian Crowd 2.5.4之前的2.5.x版本，2.6.3之前的2.6.x版本，2.3.8，2.4.9版本中存在安全漏洞。远程攻击者可通过发送包含XML外部实体声明和实体引用的DTD的请求到/services/2或services/latest，利用该漏洞读取任意文件，并发送HTTP请求到intranet服务器。
CVSS Information
N/A
Vulnerability Type
N/A