CVE-2018-20239 (GCVE-0-2018-20239)

Vulnerability from cvelistv5 – Published: 2019-04-30 15:28 – Updated: 2024-09-16 20:01
VLAI?
Summary
Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.
Severity ?
No CVSS data available.
CWE
  • Cross Site Scripting (XSS)
Assigner
References
Impacted products
Vendor Product Version
Atlassian Atlassian Application Links Affected: unspecified , < 5.0.11 (custom)
Affected: 5.1.0 , < unspecified (custom)
Affected: unspecified , < 5.2.10 (custom)
Affected: 5.3.0 , < unspecified (custom)
Affected: unspecified , < 5.3.6 (custom)
Affected: 5.4.0 , < unspecified (custom)
Affected: unspecified , < 5.4.12 (custom)
Affected: 6.0.0 , < unspecified (custom)
Affected: unspecified , < 6.0.4 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:58:18.795Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ecosystem.atlassian.net/browse/APL-1373"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/CRUC-8379"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/FE-7161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-58208"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/CWD-5362"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/JRASERVER-68855"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Atlassian Application Links",
          "vendor": "Atlassian",
          "versions": [
            {
              "lessThan": "5.0.11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "5.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.10",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.12",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2019-04-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross Site Scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-05-29T20:20:19",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ecosystem.atlassian.net/browse/APL-1373"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/CRUC-8379"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/FE-7161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/CONFSERVER-58208"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/CWD-5362"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jira.atlassian.com/browse/JRASERVER-68855"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@atlassian.com",
          "DATE_PUBLIC": "2019-04-29T00:00:00",
          "ID": "CVE-2018-20239",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Atlassian Application Links",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.0.11"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "5.1.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.2.10"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "5.3.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.3.6"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "5.4.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.4.12"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "6.0.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.0.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Atlassian"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross Site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ecosystem.atlassian.net/browse/APL-1373",
              "refsource": "MISC",
              "url": "https://ecosystem.atlassian.net/browse/APL-1373"
            },
            {
              "name": "https://jira.atlassian.com/browse/CRUC-8379",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/CRUC-8379"
            },
            {
              "name": "https://jira.atlassian.com/browse/FE-7161",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/FE-7161"
            },
            {
              "name": "https://jira.atlassian.com/browse/CONFSERVER-58208",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/CONFSERVER-58208"
            },
            {
              "name": "https://jira.atlassian.com/browse/CWD-5362",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/CWD-5362"
            },
            {
              "name": "https://jira.atlassian.com/browse/JRASERVER-68855",
              "refsource": "MISC",
              "url": "https://jira.atlassian.com/browse/JRASERVER-68855"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2018-20239",
    "datePublished": "2019-04-30T15:28:27.775475Z",
    "dateReserved": "2018-12-19T00:00:00",
    "dateUpdated": "2024-09-16T20:01:43.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.0.11\", \"matchCriteriaId\": \"2693A891-F156-4E34-B8FE-C5B50B3B4864\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.1.0\", \"versionEndExcluding\": \"5.2.10\", \"matchCriteriaId\": \"40944714-8855-458B-B776-0AF4E2AE7CDF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.3.0\", \"versionEndExcluding\": \"5.3.6\", \"matchCriteriaId\": \"D4225CCB-FD35-4B93-BC1E-85F0E83383E0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.4.0\", \"versionEndExcluding\": \"5.4.12\", \"matchCriteriaId\": \"68F3DE59-0A8E-40F9-901D-F2D3C0EA546F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0.0\", \"versionEndExcluding\": \"6.0.4\", \"matchCriteriaId\": \"C5414E46-B9B0-4ABF-9DDF-C1EBB8E829AE\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.15.2\", \"matchCriteriaId\": \"C1777CAE-0B14-4AD2-873F-CF5D3A0B79E4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.15.2\", \"matchCriteriaId\": \"6D64E9D0-0393-4871-AEE3-0D4CAD045EAE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.4.3\", \"matchCriteriaId\": \"CF812D66-1379-4421-B192-21BF9F51C1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.7.0\", \"matchCriteriaId\": \"5C140AB4-C751-4D25-B1E7-BC1729D25B4D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.7.0\", \"matchCriteriaId\": \"40DD6225-F761-4E32-B6E9-45A9C79D4AD2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.13.3\", \"matchCriteriaId\": \"75BBC078-951C-4109-A8E5-F13DD36CE837\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndExcluding\": \"8.1.0\", \"matchCriteriaId\": \"E3A2B3FB-45D3-4DB2-B10C-68E827E72837\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.13.3\", \"matchCriteriaId\": \"BF7E474F-E673-4414-A534-8E709AC6CBFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndExcluding\": \"8.1.0\", \"matchCriteriaId\": \"660409CF-397F-4D27-A331-37414A5547E5\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.\"}, {\"lang\": \"es\", \"value\": \"Application Links anterior a la versi\\u00f3n 5.0.11, desde la versi\\u00f3n 5.1.0 a la 5.2.10, desde la versi\\u00f3n 5.3.0 a la 5.3.6, desde la versi\\u00f3n 5.4.0 a la 5.4.12, y desde la versi\\u00f3n 6.0.0 a la 6.0.4, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) en el par\\u00e1metro applinkStartingUrl. El producto es usado como un complemento en varios productos de Atlassian donde se ven impactados los siguientes: Confluence anterior a la versi\\u00f3n 6.15.2, Crucible before anterior a la versi\\u00f3n 4.7.0, Crowd anterior a la versi\\u00f3n 3.4.3, Fisheye anterior a la versi\\u00f3n 4.7.0, Jira anterior a la versi\\u00f3n 7.13.3 y versi\\u00f3n 8.x anterior a 8.1.0.\"}]",
      "id": "CVE-2018-20239",
      "lastModified": "2024-11-21T04:01:08.853",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:N/I:P/A:N\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2019-04-30T16:29:00.247",
      "references": "[{\"url\": \"https://ecosystem.atlassian.net/browse/APL-1373\", \"source\": \"security@atlassian.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-58208\", \"source\": \"security@atlassian.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CRUC-8379\", \"source\": \"security@atlassian.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CWD-5362\", \"source\": \"security@atlassian.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/FE-7161\", \"source\": \"security@atlassian.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/JRASERVER-68855\", \"source\": \"security@atlassian.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://ecosystem.atlassian.net/browse/APL-1373\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-58208\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CRUC-8379\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CWD-5362\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/FE-7161\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/JRASERVER-68855\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@atlassian.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-20239\",\"sourceIdentifier\":\"security@atlassian.com\",\"published\":\"2019-04-30T16:29:00.247\",\"lastModified\":\"2024-11-21T04:01:08.853\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.\"},{\"lang\":\"es\",\"value\":\"Application Links anterior a la versi\u00f3n 5.0.11, desde la versi\u00f3n 5.1.0 a la 5.2.10, desde la versi\u00f3n 5.3.0 a la 5.3.6, desde la versi\u00f3n 5.4.0 a la 5.4.12, y desde la versi\u00f3n 6.0.0 a la 6.0.4, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) en el par\u00e1metro applinkStartingUrl. El producto es usado como un complemento en varios productos de Atlassian donde se ven impactados los siguientes: Confluence anterior a la versi\u00f3n 6.15.2, Crucible before anterior a la versi\u00f3n 4.7.0, Crowd anterior a la versi\u00f3n 3.4.3, Fisheye anterior a la versi\u00f3n 4.7.0, Jira anterior a la versi\u00f3n 7.13.3 y versi\u00f3n 8.x anterior a 8.1.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.0.11\",\"matchCriteriaId\":\"2693A891-F156-4E34-B8FE-C5B50B3B4864\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1.0\",\"versionEndExcluding\":\"5.2.10\",\"matchCriteriaId\":\"40944714-8855-458B-B776-0AF4E2AE7CDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3.0\",\"versionEndExcluding\":\"5.3.6\",\"matchCriteriaId\":\"D4225CCB-FD35-4B93-BC1E-85F0E83383E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.0\",\"versionEndExcluding\":\"5.4.12\",\"matchCriteriaId\":\"68F3DE59-0A8E-40F9-901D-F2D3C0EA546F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.4\",\"matchCriteriaId\":\"C5414E46-B9B0-4ABF-9DDF-C1EBB8E829AE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.15.2\",\"matchCriteriaId\":\"C1777CAE-0B14-4AD2-873F-CF5D3A0B79E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.15.2\",\"matchCriteriaId\":\"6D64E9D0-0393-4871-AEE3-0D4CAD045EAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.4.3\",\"matchCriteriaId\":\"CF812D66-1379-4421-B192-21BF9F51C1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.7.0\",\"matchCriteriaId\":\"5C140AB4-C751-4D25-B1E7-BC1729D25B4D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.7.0\",\"matchCriteriaId\":\"40DD6225-F761-4E32-B6E9-45A9C79D4AD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.13.3\",\"matchCriteriaId\":\"75BBC078-951C-4109-A8E5-F13DD36CE837\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.1.0\",\"matchCriteriaId\":\"E3A2B3FB-45D3-4DB2-B10C-68E827E72837\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.13.3\",\"matchCriteriaId\":\"BF7E474F-E673-4414-A534-8E709AC6CBFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.1.0\",\"matchCriteriaId\":\"660409CF-397F-4D27-A331-37414A5547E5\"}]}]}],\"references\":[{\"url\":\"https://ecosystem.atlassian.net/browse/APL-1373\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CONFSERVER-58208\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CRUC-8379\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CWD-5362\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/FE-7161\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/JRASERVER-68855\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://ecosystem.atlassian.net/browse/APL-1373\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CONFSERVER-58208\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CRUC-8379\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CWD-5362\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/FE-7161\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/JRASERVER-68855\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.