PT-2019-8255 · Atlassian · Crowd

Publicado 2019-03-29 · Atualizado 2019-04-01 · CVE-2017-18106

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Crowd versions prior to 2.9.1

Description The issue allows remote attackers who can authenticate to gain access to another user's session by making their identifier hash collide with another user's session identifier hash. This potentially enables attackers to access another user's session.

Recommendations For versions prior to 2.9.1, update to version 2.9.1 or later to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-18106

Produtos afetados

Crowd

Referências · 3

• https://jira.atlassian.com/browse/CWD-5061 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-18106 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-18106 · Aviso do Fabricante