Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-55237

The bundled Atlassian Universal Plugin Manager plugin had a XSS issue - CVE-2018-5229

XMLWordPrintable

      The version of the bundled Atlassian Universal Plugin Manager plugin had a cross site scripting vulnerability (XSS). See https://ecosystem.atlassian.net/browse/UPM-5871 for more details.

            [CONFSERVER-55237] The bundled Atlassian Universal Plugin Manager plugin had a XSS issue - CVE-2018-5229

            Minh Tran added a comment -

            If you're running the Confluence 6.6 Enterprise release, a fix for this issue is now available in Confluence 6.6.10, which you can find in the Download Archives.

            Minh Tran added a comment - If you're running the Confluence 6.6 Enterprise release, a fix for this issue is now available in Confluence 6.6.10, which you can find in the Download Archives .

            Minh Tran added a comment -

            A fix for this issue is available to Server and Data Center customers in Confluence 6.8.2
            Upgrade now or check out the Release Notes to see what other issues are resolved.

            Minh Tran added a comment - A fix for this issue is available to Server and Data Center customers in Confluence 6.8.2 Upgrade now or check out the Release Notes to see what other issues are resolved.

            David Black added a comment - - edited

            This is an independent assessment and you should evaluate its applicability to your own IT environment.
            CVSS v3 score: 8.0 => High severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required Low
            User Interaction Required

            Scope Metric

            Scope Unchanged

            Impact Metrics

            Confidentiality High
            Integrity High
            Availability High

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

            David Black added a comment - - edited This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 8.0 => High severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction Required Scope Metric Scope Unchanged Impact Metrics Confidentiality High Integrity High Availability High https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

              mtran@atlassian.com Minh Tran
              dblack David Black
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: