CVE-2017-18106

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Atlassian	Crowd	>= unspecified, < 2.9.1

References

https://jira.atlassian.com/browse/CWD-5061Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CWD-5061Issue Tracking, Vendor Advisory

Timeline

Published: Mar 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-181076.5Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and del CVE-2017-181087.2The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights t CVE-2017-181096.1The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to CVE-2017-181106.5The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote CVE-2017-181118.7The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before CVE-2017-181126.5Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulner CVE-2017-181138.8The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a sy CVE-2017-181207.8A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or uns CVE-2017-181216.1The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links CVE-2017-181228.1A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will re CVE-2017-181238.6The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file CVE-2017-181247.8During secure boot, addition is performed on uint8 ptrs which led to overflow issue in Small Cell SoC, Snapdragon Automobile, Snapdragon Mob