CyberSec.Space Logo
Back to CVE Browser

CVE-2018-20238

HIGH
8.1
CVSS Severity Score
EPSS Score0.0520%
EPSS Percentile7.47th
PublishedFeb 13, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.

Affected Platforms (CPE)

📦
Atlassian

Crowd

< 3.2.7
📦
Atlassian

Crowd

>= 3.3.0 and < 3.3.4

References & Advisories

🔗 http://www.securityfocus.com/bid/107036
🔗 https://jira.atlassian.com/browse/CWD-5361
🔗 http://www.securityfocus.com/bid/107036
🔗 https://jira.atlassian.com/browse/CWD-5361

Related Vulnerabilities

CVE-2016-64969.8

The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary c...

CVE-2019-115809.8

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who c...

CVE-2012-29269.1

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8,...

CVE-2017-181058.1

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attac...