Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 3.5.0, 3.4.3
Affects Version/s: None
Component/s: None
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The version of the Application Links plugin used in Crowd before version 3.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. See https://ecosystem.atlassian.net/browse/APL-1373 for more details.

Attachments

Issue Links

relates to

JRASERVER-68855 XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

Closed

BAM-20254 XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

Closed

APL-1370 Loading...

BBSDEV-19392 Loading...

SECURITY-1179 Loading...

is related to: APL-1373 Loading...

mentioned in: Page Loading...

(1 is related to, 1 mentioned in)

Activity

People

Assignee:: Unassigned

Reporter:: David Black

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Due:: 11/Apr/2019

Created:: 14/Feb/2019 3:17 AM

Updated:: 04/Nov/2022 2:43 PM

Resolved:: 03/Apr/2019 1:47 PM