VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 29, 2019· Updated Jun 17, 2026

CVE-2017-18106

CVE-2017-18106

Description

The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Atlassian/Crowd3 versions
    cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*range: <2.9.1
    • (no CPE)range: <2.9.1
    • (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.