The vulnerability is an XML External Entity Injection flaw that allows an attacker with valid credentials in Atlassian Crowd Data Center and Server to read local or remote files and resources, potentially exposing sensitive data. The attack does not require any user interaction, yet it can compromise confidentiality severely and disturb availability, while causing minimal integrity damage. This unchecked external entity resolution is a classic CWE‑611 weakness.

The flaw appears in Crowd Data Center and Server starting with version 7.1.0 and persists through the 7.1.2 series. Upgrading to any release 7.1.3 or later removes the vulnerability. The affected product is Atlassian Crowd Data Center and Server; no other vendors or products are mentioned.

The CVSS base score is 7.9, indicating a high severity. The EPSS score is below 1 %, suggesting that widespread exploitation is currently unlikely, and the vulnerability is not yet catalogued as a known exploited vulnerability by CISA. An attacker must possess authenticated access; once authenticated, the path to the vulnerable XML parsing code is straightforward, making exploitation simple for insiders or compromised accounts. The lack of a user‑interaction requirement and the high impact on confidentiality and availability suggest that enterprises should treat this as a priority flaw.