CVE-2018-20238

Опубликовано: 13 фев. 2019

Источник: nvd

CVSS3: 8.1

CVSS2: 5.5

EPSS Низкий

Описание

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.

Ссылки

http://www.securityfocus.com/bid/107036
Third Party Advisory
VDB Entry
https://jira.atlassian.com/browse/CWD-5361
Vendor Advisory
http://www.securityfocus.com/bid/107036
Third Party Advisory
VDB Entry
https://jira.atlassian.com/browse/CWD-5361
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*

Версия до 3.2.7 (исключая)

cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*

Версия от 3.3.0 (включая) до 3.3.4 (исключая)

EPSS

Процентиль: 42%

0.00205

Низкий

8.1 High

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-384

Связанные уязвимости

GHSA-jj3c-2ggq-fxgg