TI-2018-14345 Aliases CVE-2018-20238 GHSA-jj3c-2ggq-fxgg

Session fixation in Atlassian Crowd

LOW 38CWE-384Published 2019-02-13 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-384.

Summary

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.

Why it matters now

EPSS 0.01513 74th percentileScored 2026-11-07

Fix Fixed Crowd (Atlassian): 3.2.7, 3.3.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Crowd	before 3.2.7; 3.3.0 and later; before 3.3.4	3.2.7, 3.3.4	Patch available	CNA

Crowd VendorAtlassian Affected before 3.2.7; 3.3.0 and later; before 3.3.4 Fixed in 3.2.7, 3.3.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:crowd::::::::	before 3.2.7; 3.3.0 to before 3.3.4	Vulnerable	Atlassian

cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions before 3.2.7; 3.3.0 to before 3.3.4 Vulnerable ·Atlassian

Remediation

Fix · CNA Crowd (Atlassian) Fixed in 3.2.7, 3.3.4

Timeline

2026-10-02 Threatist record created from CVE-2018-20238
2026-10-03 Alias added: GHSA-jj3c-2ggq-fxgg

References

Advisory 1

https://jira.atlassian.com/browse/CWD-5361

TI-2019-08653 Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly… KEVCVSS 3.1CRITICAL 9.8
TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
TI-2022-21516 Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd… CVSS 3.1CRITICAL 9.8
TI-2016-05568 The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5… CVSS 3.0CRITICAL 9.8

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences