CVE-2018-20239
Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.1…
Published 7 y ago · modified 4 mo ago · JSON
Summary
Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.
Exploit prediction (EPSS)
3.34% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- Atlassian Atlassian Application Links
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- ecosystem.atlassian.net /browse/APL-1373 · x_refsource_MISC, x_transferred
- jira.atlassian.com /browse/CRUC-8379 · x_refsource_MISC, x_transferred
- jira.atlassian.com /browse/FE-7161 · x_refsource_MISC, x_transferred
- jira.atlassian.com /browse/CONFSERVER-58208 · x_refsource_MISC, x_transferred
- jira.atlassian.com /browse/CWD-5362 · x_refsource_MISC, x_transferred
- jira.atlassian.com /browse/JRASERVER-68855 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-20239
- NVD: CVE-2018-20239
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.