CVE-2017-18107

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.4%
top 38.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Atlassian Crowd
Timeline
PublishedDec 17
Latest updateMay 24

Description

Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery (CSRF) vulnerability. Please be aware that the Demo application is not enabled by default.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5atlassian/crowdunspecified — 3.1.1
▶NVDatlassian/crowd< 3.1.1

🔴Vulnerability Details

2
GHSA
GHSA-5r7h-75x2-554g: Various resources in the Crowd Demo application of Atlassian Crowd before version 3↗2022-05-24
▶
CVEList
CVE-2017-18107: Various resources in the Crowd Demo application of Atlassian Crowd before version 3↗2019-12-17
▶
CVE-2017-18107 (MEDIUM CVSS 6.5) | Various resources in the Crowd Demo | cvebase.io