Cross-Site Request Forgery Vulnerability in Atlassian Universal Plugin Manager
CVE-2019-14999

4.3MEDIUM

Key Information:

Vendor
Atlassian
Status
Universal Plugin Manager
Vendor
CVE Published:
23 August 2019

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists within the Uninstall REST endpoint of the Atlassian Universal Plugin Manager, affecting specific versions prior to 2.22.19, as well as selected versions of 3.0.0 and 4.0.0. This flaw enables authenticated remote attackers to exploit the system and uninstall plugins without appropriate authorization, potentially compromising the integrity of the application and allowing unauthorized actions.

Affected Version(s)

Universal Plugin Manager < 2.22.19

Universal Plugin Manager 3.0.0

Universal Plugin Manager < 3.0.3

References

https://ecosystem.atlassian.net/browse/UPM-6044
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.