Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Atlassian Crowd 3.0.2, 3.1.1, unspecified Clear all filters
TI-2017-13317 CVE-2017-18110 · GHSA-6w64-j998-2q4m

XML external entity injection in Atlassian Crowd

Priority LOW 31

The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01211 Published 2019-03-29 Fixed in 3.0.2, 3.1.1 CWE-611
TI-2017-13316 CVE-2017-18109 · GHSA-3jv4-c99q-p2j6

Open redirect in Atlassian Crowd

Priority LOW 30

The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01131 Published 2019-03-29 Fixed in 3.0.2, 3.1.1 CWE-601
TI-2017-13312 CVE-2017-18105 · GHSA-qq79-32v4-8c7v

Session fixation in Atlassian Crowd

Priority LOW 38

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of t…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01427 Published 2019-03-29 Fixed in 3.0.2, 3.1.1 CWE-384