[%22Issue] XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 4.7.0
Affects Version/s: 4.6.1
Component/s: Integrations
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The version of the Application Links plugin used in Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. See https://ecosystem.atlassian.net/browse/APL-1373 for more details.

is related to

FE-7161 XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

Closed

APL-1373 XSS in the listApplicationLinks resource - CVE-2018-20239

Done

relates to: SECURITY-1179 Failed to load

Security Metrics Bot added a comment - 14/Feb/2019 5:42 PM

This is an independent assessment and you should evaluate its applicability to your own IT environment.
CVSS v3 score: 5.4 => Medium severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	Required

Scope Metric

Scope	Changed

Impact Metrics

Confidentiality	Low
Integrity	Low
Availability	None

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Security Metrics Bot added a comment - 14/Feb/2019 5:42 PM This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 5.4 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality Low Integrity Low Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 3 Start watching this issue

Created:: 14/Feb/2019 7:04 PM

Updated:: 01/Jun/2023 4:36 PM

Resolved:: 14/Feb/2019 7:35 PM

Details

Description

Attachments

Issue Links

Forms

Activity

[CRUC-8379] XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

Collapse comment: Security Metrics Bot added a comment - 14/Feb/2019 5:42 PM

Expand comment: Security Metrics Bot added a comment - 14/Feb/2019 5:42 PM

People

Dates