[CRUC-8379] XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 4.7.0
Affects Version/s: 4.6.1
Component/s: Integrations
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The version of the Application Links plugin used in Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. See https://ecosystem.atlassian.net/browse/APL-1373 for more details.

is related to

FE-7161 XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

Closed

APL-1373 Loading...

relates to: SECURITY-1179 Failed to load

Form Name

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 3 Start watching this issue

Created:: 14/Feb/2019 7:04 PM

Updated:: 01/Jun/2023 4:36 PM

Resolved:: 14/Feb/2019 7:35 PM

Details

Description

Attachments

Issue Links

Forms

Activity

[CRUC-8379] XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

People

Dates