Crowd 2.11.1 - Apache Struts2 REST XStream Vulnerability

[Balaji Neyveli]

Hi,

Can you please verify if Crowd 2.11.1 version is affected by the  Apache Struts2 REST XStream Vulnerability (CVE-2017-9805)  ?

The REST plugin seems to be integrated into Crowd since 2.0.

Is Crowd using the REST plugin with XML? 

If so will there be a patch for it?

Thanks,

[Boris Berenberg - Atlas Authority · Accepted solution]

Looks like nope: https://twitter.com/JIRA/status/905486179901906944

[Balaji Neyveli]

Thanks for the reply. It is great that Atlassian is so fast to respond to these issues. Helps us a lot.