Session Token Identifier Collision in Atlassian Crowd

CVE-2017-18106

Summary

A vulnerability in Atlassian Crowd allows an attacker to exploit session token identifiers. If an attacker authenticates to Crowd or an associated application, they may manipulate their identifier_hash to collide with that of another user. This collision could enable unauthorized access to another user's session, exposing sensitive information and compromising user accounts.

References