CVE-2017-18106

The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash.

CVSS v3 7.5 HIGH
CVSS v2.0 6.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://jira.atlassian.com/browse/CWD-5061	Issue Tracking Vendor Advisory
https://jira.atlassian.com/browse/CWD-5061	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:19

Type	Values Removed	Values Added
References	~~() https://jira.atlassian.com/browse/CWD-5061 - Issue Tracking, Vendor Advisory~~	() https://jira.atlassian.com/browse/CWD-5061 - Issue Tracking, Vendor Advisory

Information

Published : 2019-03-29 14:29

Updated : 2024-11-21 03:19

NVD link : CVE-2017-18106

Mitre link : CVE-2017-18106

CVE.ORG link : CVE-2017-18106

JSON object : View

Products Affected

atlassian

crowd

CWE

CWE-287

Improper Authentication

{"id": "CVE-2017-18106", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2019-03-29T14:29:00.313", "references": [{"url": "https://jira.atlassian.com/browse/CWD-5061", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "https://jira.atlassian.com/browse/CWD-5061", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash."}, {"lang": "es", "value": "Un hash de identificaci\u00f3n para un token de sesi\u00f3n en Atlassian Crowd, en versiones anteriores a la 2.9.1, podr\u00eda colisionar con un identifier_hash para otro usuario o un usuario en un directorio diferente. Esto permite a los atacantes remotos obtener acceso a la sesi\u00f3n de otro usuario, con tal de que puedan hacer que su hash de identificaci\u00f3n colisione con el hash de identificaci\u00f3n de la sesi\u00f3n de otro usuario."}], "lastModified": "2024-11-21T03:19:22.283", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC94F873-D56A-4527-94D2-00B3677E6592", "versionEndExcluding": "2.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}