[CWD-5361] Insufficient Session Expiration of user sessions - CVE-2018-20238 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: High
Fix Version/s: 3.4.0, 3.2.7, 3.3.4
Affects Version/s: 3.2.0, 3.2.1, 3.2.3, 3.3.0, 3.2.4, 3.2.5, 3.3.1, 3.2.6, 3.3.3
Component/s: None
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.

mentioned in: Page Failed to load

relates to: KRAK-1774 You do not have permission to view this issue

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 13/Feb/2019 12:37 AM

Updated:: 10/Dec/2019 3:29 AM

Resolved:: 13/Feb/2019 12:47 AM

Crowd Data Center

Details

Description

Attachments

Issue Links

Forms

Activity

[CWD-5361] Insufficient Session Expiration of user sessions - CVE-2018-20238

People

Dates