CVE-2018-20233 The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perfor...
MediumCVSS 6.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian universal plugin manager | < 2.22.14 | 2.22.14 |
References
- 106661 third-party-advisory vdb-entry
- ecosystem.atlassian.net issue-tracking vendor-advisory