Atlassian Application Links CVE-2018-5227 Cross Site Scripting Vulnerability

Bugtraq ID:	103731
Class:	Input Validation Error
CVE:	CVE-2018-5227
Remote:	Yes
Local:	No
Published:	Apr 10 2018 12:00AM
Updated:	Apr 10 2018 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Atlassian JIRA 7.8.1 Atlassian Confluence 6.7.1 Atlassian Application Links 5.4.3 Atlassian Application Links 5.4.2 Atlassian Application Links 5.4.1 Atlassian Application Links 5.4.0
Not Vulnerable:	Atlassian JIRA 7.9 Atlassian JIRA 7.7.3 Atlassian JIRA 7.6.5 Atlassian JIRA 7.8.2 Atlassian Confluence 6.7.2 Atlassian Bitbucket Server 5.9 Atlassian Bamboo 6.5.0 Atlassian Application Links 5.4.4

Atlassian Application Links CVE-2018-5227 Cross Site Scripting Vulnerability

Atlassian Application Links is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Atlassian Application Links 5.4.4 are vulnerable.

Atlassian Application Links CVE-2018-5227 Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Atlassian Application Links CVE-2018-5227 Cross Site Scripting Vulnerability

References:

• Atlassian Application links Homepage (Atlassian)
  
• XSS in various administrative application link resources through the display url (Atlassian)