Vulnerability Description
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Universal Plugin Manager | < 2.22.14 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/106661Third Party AdvisoryVDB Entry
- https://ecosystem.atlassian.net/browse/UPM-5964Issue TrackingVendor Advisory
- http://www.securityfocus.com/bid/106661Third Party AdvisoryVDB Entry
- https://ecosystem.atlassian.net/browse/UPM-5964Issue TrackingVendor Advisory
FAQ
What is CVE-2018-20233?
CVE-2018-20233 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perfor...
How severe is CVE-2018-20233?
CVE-2018-20233 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-20233?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Universal Plugin Manager.