CVE-2017-18109
Last modified
CVE-2017-18109 is a vulnerability of currently unknown severity. The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.. EPSS estimates a 1.13% chance of exploitation in the next 30 days.
Description
The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Crowd | < 3.0.2 |
| Atlassian | Crowd | 3.1.0 |
References
- https://jira.atlassian.com/browse/CWD-5071Issue Tracking, Vendor Advisory
- https://jira.atlassian.com/browse/CWD-5071Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-18109?
How severe is CVE-2017-18109?
How do I fix CVE-2017-18109?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-18103The atlassian-http library, as used in various Atlassian pro…
- CVE-2017-18104The Webhooks component of Atlassian Jira before version 7.6.…
- CVE-2017-18105The console login resource in Atlassian Crowd before version…
- CVE-2017-18106The identifier_hash for a session token in Atlassian Crowd b…
- CVE-2017-18107Various resources in the Crowd Demo application of Atlassian…6.5
- CVE-2017-18108The administration SMTP configuration resource in Atlassian …
- CVE-2017-1811Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2017-18110The administration backup restore resource in Atlassian Crow…
- CVE-2017-18111The OAuthHelper in Atlassian Application Links before versio…
- CVE-2017-18112Affected versions of Atlassian Fisheye allow remote attacker…6.5
- CVE-2017-18113The DefaultOSWorkflowConfigurator class in Jira Server and J…8.8
- CVE-2017-1812Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
Are you affected by CVE-2017-18109?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST