CVE-2018-20238

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
Atlassian	Crowd	>= unspecified, < 3.2.7; >= 3.3.0, < unspecified; >= unspecified, < 3.3.4

References

http://www.securityfocus.com/bid/107036Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CWD-5361Vendor Advisory
http://www.securityfocus.com/bid/107036Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CWD-5361Vendor Advisory

Timeline

Published: Feb 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-202395.4Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12 CVE-2018-20248.1IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified CVE-2018-202404.8The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary H CVE-2018-202415.4The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTM CVE-2018-202426.1A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijack CVE-2018-202437.5The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fi CVE-2018-202445.5In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrar CVE-2018-202457.5The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper chec CVE-2018-202477.8In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page tree CVE-2018-202489.8In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table poi CVE-2018-202498.8In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries u CVE-2018-20254.4IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CI