CVE-2018-20238

8.1 highEPSS 1.5%

Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.

Severity

CVSS 3.0

8.1 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-384
Published: 2019-02-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:crowd

References

http://www.securityfocus.com/bid/107036
https://jira.atlassian.com/browse/CWD-5361
http://www.securityfocus.com/bid/107036
https://jira.atlassian.com/browse/CWD-5361

Check your stack JSON