SB2019021328 - Session Fixation in Atlassian Crowd
Published: February 13, 2019 Updated: July 17, 2020
Security Bulletin ID
SB2019021328
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Session Fixation (CVE-ID: CVE-2018-20238)
The vulnerability allows a remote authenticated user to read and manipulate data.
Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.
Remediation
Install update from vendor's website.