Cross Site Scripting Vulnerability in Atlassian Universal Plugin Manager
CVE-2018-5229

5.4MEDIUM

Key Information:

Vendor
Atlassian
Status
Universal Plugin Manager
Vendor
CVE Published:
16 July 2018

Summary

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager prior to version 2.22.9 is vulnerable to cross site scripting (XSS), enabling remote attackers to inject arbitrary HTML or JavaScript. This vulnerability particularly occurs via manipulation of user submitted add-on names, posing risks to affected systems by potentially executing malicious scripts within a user's browser.

Affected Version(s)

Universal Plugin Manager < 2.22.9

References

https://ecosystem.atlassian.net/browse/UPM-5871
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.