CVE-2018-20238

moderate-risk

Published 2019-02-13

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.

Do I need to act?

0.21% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / LOW complexity

Affected Products (1)

Crowd

Affected Vendors

Atlassian

References (4)

Third Party Advisory http://www.securityfocus.com/bid/107036

Vendor Advisory https://jira.atlassian.com/browse/CWD-5361

Third Party Advisory http://www.securityfocus.com/bid/107036

Vendor Advisory https://jira.atlassian.com/browse/CWD-5361

/ 100

moderate-risk

Severity 28/34 · Critical

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal