Lucene search

Security-metrics-botJRASERVER-67723

HistoryAug 07, 2018 - 4:20 a.m.

The bundled Atlassian Universal Plugin Manager plugin had a XXE issue - CVE-2018-20233

2018-08-0704:20:40

security-metrics-bot

jira.atlassian.com

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

0.003 Low

EPSS

Percentile

66.3%

JSON

The version of the bundled Atlassian Universal Plugin Manager plugin had a XML External Entity vulnerability that allowed remote attackers with system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR. See https://ecosystem.atlassian.net/browse/UPM-5964 for more details.

Affected configurations

Vulners

Node

atlassianjira_data_centerRange≤7.12.1

atlassianjira_data_centerRange<7.8.5

atlassianjira_data_centerRange<7.7.5

atlassianjira_data_centerRange<7.9.3

atlassianjira_data_centerRange<7.10.3

atlassianjira_data_centerRange<7.11.3

atlassianjira_data_centerRange<7.12.4

atlassianjira_data_centerRange<7.13.1

atlassianjira_data_centerRange<7.6.10

CPENameOperatorVersion
jira data centerle7.12.1
jira data centerlt7.8.5
jira data centerlt7.7.5
jira data centerlt7.9.3
jira data centerlt7.10.3
jira data centerlt7.11.3
jira data centerlt7.12.4
jira data centerlt7.13.1
jira data centerlt7.6.10

Name	Operator	Version
jira data center	le	7.12.1
jira data center	lt	7.8.5
jira data center	lt	7.7.5
jira data center	lt	7.9.3
jira data center	lt	7.10.3
jira data center	lt	7.11.3
jira data center	lt	7.12.4
jira data center	lt	7.13.1
jira data center	lt	7.6.10

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

0.003 Low

EPSS

Percentile

66.3%

JSON

Related for JRASERVER-67723