High severity · published Mar 29, 2019
CVE-2017-18106
The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different…
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Crowd · Atlassian
before 2.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-18106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-18106
Issue Tracking
https://jira.atlassian.com/browse/CWD-5061
More from Crowd
9.8
CVE-2019-11580
Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
7.5
CVE-2026-21589
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
9.8
CVE-2022-43782
Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints…
9.8
CVE-2022-26136
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps
9.8
CVE-2016-6496
The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted…