CVE-2018-20233

EPSS 0.77%
Veröffentlicht 18.01.2019 21:29:00
Zuletzt bearbeitet 21.11.2024 04:01:08
Quelle security@atlassian.com
CVE-Watchlists
Login
Unerledigt
Login

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Atlassian ≫ Universal Plugin Manager Version < 2.22.14

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.77%	0.722

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.5	1.2	5.2	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
nvd@nist.gov	5.5	8	4.9	AV:N/AC:L/Au:S/C:P/I:N/A:P

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

http://www.securityfocus.com/bid/106661

Third Party Advisory

VDB Entry

https://ecosystem.atlassian.net/browse/UPM-5964

Vendor Advisory

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2018-20233

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-20233

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-20233

EUVD