CVE-2017-18105

Published: Mar 29, 2019Modified: Nov 21, 2024

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation vulnerability.

Affected (2)

Products: Atlassian: Crowd

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Atlassian Crowd	Before 3.0.2
Atlassian Crowd	From 3.1.0 to 3.1.1

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://jira.atlassian.com/browse/CWD-5072

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/CWD-5072

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.