PT-2023-25665 · Atlassian · User Management For Bitbucket+2

Carl Nykvist · CVE-2023-36662 · Published 2023-06-26 · Updated 2023-07-06

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Management for Jira versions 2.0.0 through 2.17.1 User Management for Confluence versions 2.0.0 through 2.15.24 User Management for Bitbucket versions 2.2.2 through 2.15.24

Description The TechTime User Management components for Atlassian products are affected by a stored XSS issue on the Bulk User Actions page.

Recommendations For User Management for Jira versions 2.0.0 through 2.17.1, update to a version outside of this range to resolve the issue. For User Management for Confluence versions 2.0.0 through 2.15.24, update to a version outside of this range to resolve the issue. For User Management for Bitbucket versions 2.2.2 through 2.15.24, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the Bulk User Actions page until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-36662

Affected Products

User Management For Bitbucket

User Management For Confluence

User Management For Jira

References · 4

• https://osv.dev/vulnerability/CVE-2023-36662 · Vendor Advisory
• https://techtime.co.nz/display/TECHTIME/Security+Vulnerability+Affecting+User+Management · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36662 · Security Note
• https://t.me/cvenotify/53036 · Telegram Post