[JRASERVER-68855] XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium (View bug fix roadmap)
Fix Version/s: 8.1.0, 7.13.3
Affects Version/s: 7.13.0, 7.13.1, 8.0.0
Component/s: Application Links
Labels:

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.13
Support reference count:
1
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The version of the Application Links plugin used in Jira before version 7.13.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. See https://ecosystem.atlassian.net/browse/APL-1373 for more details.

is related to

CWD-5362 XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

Closed

APL-1373 Loading...

details: APL-1370 Failed to load

relates to: BBSDEV-19392 You do not have permission to view this issue; RAID-1119 You do not have permission to view this issue; SECURITY-1179 Loading...

(1 relates to)

Mark Thomas added a comment - 03/May/2019 11:36 AM

Is there a fix in the 8.0.x version series?

Mark Thomas added a comment - 03/May/2019 11:36 AM Is there a fix in the 8.0.x version series?

David Black added a comment - 14/Feb/2019 2:53 AM - edited

This is an independent assessment and you should evaluate its applicability to your own IT environment.

CVSS v3 score: 5.4 => Medium severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	Required

Scope Metric

Scope	Changed

Impact Metrics

Confidentiality	Low
Integrity	Low
Availability	None

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

David Black added a comment - 14/Feb/2019 2:53 AM - edited This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 5.4 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality Low Integrity Low Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Assignee:: Ignat (Inactive)

Reporter:: David Black

Affected customers:: 0 This affects my team

Watchers:: 2 Start watching this issue

Created:: 14/Feb/2019 2:51 AM

Updated:: 31/May/2023 9:45 PM

Resolved:: 04/Apr/2019 11:56 AM

Details

Description

Attachments

Issue Links

Forms

Activity

[JRASERVER-68855] XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

Collapse comment: Mark Thomas added a comment - 03/May/2019 11:36 AM

Expand comment: Mark Thomas added a comment - 03/May/2019 11:36 AM

Collapse comment: David Black added a comment - 14/Feb/2019 2:53 AM, Edited by David Black - 30/Apr/2019 2:28 AM

Expand comment: David Black added a comment - 14/Feb/2019 2:53 AM, Edited by David Black - 30/Apr/2019 2:28 AM

People

Dates