• Type: Bug
• Resolution: Fixed
• Priority: High (View bug fix roadmap)
• Fix Version/s: 7.10.0, 7.9.2, 7.7.4, 7.8.4, 7.6.7
• Affects Version/s: 7.6.0, 7.7.0, 7.8.0, 7.9.0
• Component/s: UPM (Universal Plugin Manager)
• Labels:

  • advisory
  • advisory-released
  • cvss-high
  • patch-management
  • raid
  • security

[JRASERVER-66748] The bundled Atlassian Universal Plugin Manager plugin had a XSS issue - CVE-2018-5229

Collapse comment: David Black added a comment - 18/Apr/2018 7:59 AM, Edited by David Black - 23/Jul/2018 6:50 AM

David Black added a comment - 18/Apr/2018 7:59 AM - edited

This is an independent assessment and you should evaluate its applicability to your own IT environment.
CVSS v3 score: 8.0 => High severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	Required

Scope Metric

Scope	Unchanged

Impact Metrics

Confidentiality	High
Integrity	High
Availability	High

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Expand comment: David Black added a comment - 18/Apr/2018 7:59 AM, Edited by David Black - 23/Jul/2018 6:50 AM

David Black added a comment - 18/Apr/2018 7:59 AM - edited This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 8.0 => High severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction Required Scope Metric Scope Unchanged Impact Metrics Confidentiality High Integrity High Availability High https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H