CVE-2017-18105

HIGH

Atlassian Crowd <3.0.2, >3.1.0-<3.1.1 - Session Fixation

Title source: llm
STIX 2.1

Description

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation vulnerability.

References (1)

Core 1
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://jira.atlassian.com/browse/CWD-5072

Scores

CVSS v3 8.1
EPSS 0.0051
EPSS Percentile 66.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-384
Status published
Products (1)
atlassian/crowd < 3.0.2
Published Mar 29, 2019
Tracked Since Feb 18, 2026