Vulnerability Description
The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2.1 and 3.3.7
CVSS Score
7.5
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ttpsc | The Scheduler | 5.1.3 |
Related Weaknesses (CWE)
References
- https://marketplace.atlassian.com/apps/37456/the-scheduler?hosting=server&tab=veThird Party Advisory
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-Third Party Advisory
- https://marketplace.atlassian.com/apps/37456/the-scheduler?hosting=server&tab=veThird Party Advisory
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-Third Party Advisory
FAQ
What is CVE-2018-14383?
CVE-2018-14383 is a vulnerability with a CVSS score of 7.5 (HIGH). The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2.1 and 3.3.7
How severe is CVE-2018-14383?
CVE-2018-14383 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-14383?
Check the references section above for vendor advisories and patch information. Affected products include: Ttpsc The Scheduler.