• Type: Bug
• Resolution: Fixed
• Priority: High
• Fix Version/s: 5.10.0, 5.9.1
• Affects Version/s: 5.7.1
• Component/s: None
• Labels:

  • advisory
  • advisory-released
  • cvss-high
  • patch-management
  • security

[BSERV-10606] The bundled Atlassian Universal Plugin Manager plugin had a XSS issue - CVE-2018-5229

Collapse comment: David Black added a comment - 07/Feb/2018 10:19 PM, Edited by David Black - 23/Jul/2018 6:53 AM

David Black added a comment - 07/Feb/2018 10:19 PM - edited

This is an independent assessment and you should evaluate its applicability to your own IT environment.
CVSS v3 score: 8.0 => High severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	Required

Scope Metric

Scope	Unchanged

Impact Metrics

Confidentiality	High
Integrity	High
Availability	High

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Expand comment: David Black added a comment - 07/Feb/2018 10:19 PM, Edited by David Black - 23/Jul/2018 6:53 AM

David Black added a comment - 07/Feb/2018 10:19 PM - edited This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 8.0 => High severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction Required Scope Metric Scope Unchanged Impact Metrics Confidentiality High Integrity High Availability High https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H