Session Fixation Vulnerability in Atlassian Crowd Affected by Cookie Management Issues

CVE-2017-18105

What is CVE-2017-18105?

A session fixation vulnerability exists in Atlassian Crowd which allows remote attackers to exploit the system by utilizing a user's JSESSIONID cookie. This vulnerability can lead to unauthorized access to internal and third-party REST resources, potentially compromising sensitive data and user sessions. Attackers must first gain access to a legitimate user's cookie to exploit this flaw, thereby emphasizing the importance of robust session management practices.

References