PT-2018-16820 · Atlassian · Universal Plugin Manager+1

Publicado 2018-07-16 · Atualizado 2018-09-12 · CVE-2018-5229

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Universal Plugin Manager version 2.22.8 and earlier

Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of user-submitted add-on names, specifically affecting the NotificationRepresentationFactoryImpl class.

Recommendations For Atlassian Universal Plugin Manager version 2.22.8 and earlier, update to version 2.22.9 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-5229

Produtos afetados

Universal Plugin Manager

Jira

Referências · 3

• https://ecosystem.atlassian.net/browse/UPM-5871 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-5229 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5229 · Nota de Segurança