Atlassian Universal Plugin Manager CVE-2018-5229 Cross Site Scripting Vulnerability
BID:104891
Info
Atlassian Universal Plugin Manager CVE-2018-5229 Cross Site Scripting Vulnerability
| Bugtraq ID: | 104891 |
| Class: | Input Validation Error |
| CVE: |
CVE-2018-5229 |
| Remote: | Yes |
| Local: | No |
| Published: | May 10 2018 12:00AM |
| Updated: | May 10 2018 12:00AM |
| Credit: | SecurityB |
| Vulnerable: |
Atlassian Universal Plugin Manager 2.22.8 Atlassian Universal Plugin Manager 2.21.5 Atlassian Universal Plugin Manager 2.20.7 Atlassian Universal Plugin Manager 2.19.6 Atlassian Universal Plugin Manager 2.17.17 Atlassian Universal Plugin Manager 2.16.5 Atlassian Universal Plugin Manager 2.15.3 Atlassian Universal Plugin Manager 1.6.4 Atlassian Universal Plugin Manager 1.6.1 Atlassian Universal Plugin Manager 2.22 Atlassian Universal Plugin Manager 2.21 Atlassian Universal Plugin Manager 2.20 Atlassian Universal Plugin Manager 2.19 Atlassian Universal Plugin Manager 2.18 Atlassian Universal Plugin Manager 2.17 Atlassian Universal Plugin Manager 2.16 Atlassian Universal Plugin Manager 2.15 Atlassian Universal Plugin Manager 2.10 Atlassian Universal Plugin Manager 2.0 Atlassian Universal Plugin Manager 1.5 Atlassian Universal Plugin Manager 1.4 Atlassian Universal Plugin Manager 1.0 |
| Not Vulnerable: |
Atlassian Universal Plugin Manager 2.22.9 |
Discussion
Atlassian Universal Plugin Manager CVE-2018-5229 Cross Site Scripting Vulnerability
Atlassian Universal Plugin Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to Universal Plugin Manager 2.22.9 are vulnerable.
Atlassian Universal Plugin Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to Universal Plugin Manager 2.22.9 are vulnerable.
Exploit / POC
Atlassian Universal Plugin Manager CVE-2018-5229 Cross Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
Atlassian Universal Plugin Manager CVE-2018-5229 Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Atlassian Universal Plugin Manager CVE-2018-5229 Cross Site Scripting Vulnerability
References:
References:
- Atlassian Homepage (Atlassian)
- Jira Homepage (Atlassian)
- XSS through user requested add-on names - CVE-2018-5229 (Atlassian)