CVE-2017-16858

CVE-2017-16858 is a medium-severity vulnerability affecting Atlassian Crowd versions 1.5.0 through 3.1.1. It allowed an authenticated attacker to impersonate a Crowd user in REST requests by exploiting a flaw in the 'crowd-application' plugin module, particularly when multiple directories with identically named users were configured. The attack vector is network-based with high attack complexity, requiring low privileges, and could lead to high confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage for this vulnerability.