{"containers": {"cna": {"affected": [{"product": "Atlassian Application Links", "vendor": "Atlassian", "versions": [{"lessThan": "5.0.11", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "5.1.0", "versionType": "custom"}, {"lessThan": "5.2.10", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "5.3.0", "versionType": "custom"}, {"lessThan": "5.3.6", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "5.4.0", "versionType": "custom"}, {"lessThan": "5.4.12", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "6.0.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-04-29T00:00:00", "descriptions": [{"lang": "en", "value": "Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0."}], "problemTypes": [{"descriptions": [{"description": "Cross Site Scripting (XSS)", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-05-29T20:20:19", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ecosystem.atlassian.net/browse/APL-1373"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/CRUC-8379"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/FE-7161"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/CONFSERVER-58208"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/CWD-5362"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/JRASERVER-68855"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2019-04-29T00:00:00", "ID": "CVE-2018-20239", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Atlassian Application Links", "version": {"version_data": [{"version_affected": "<", "version_value": "5.0.11"}, {"version_affected": ">=", "version_value": "5.1.0"}, {"version_affected": "<", "version_value": "5.2.10"}, {"version_affected": ">=", "version_value": "5.3.0"}, {"version_affected": "<", "version_value": "5.3.6"}, {"version_affected": ">=", "version_value": "5.4.0"}, {"version_affected": "<", "version_value": "5.4.12"}, {"version_affected": ">=", "version_value": "6.0.0"}, {"version_affected": "<", "version_value": "6.0.4"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross Site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://ecosystem.atlassian.net/browse/APL-1373", "refsource": "MISC", "url": "https://ecosystem.atlassian.net/browse/APL-1373"}, {"name": "https://jira.atlassian.com/browse/CRUC-8379", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/CRUC-8379"}, {"name": "https://jira.atlassian.com/browse/FE-7161", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/FE-7161"}, {"name": "https://jira.atlassian.com/browse/CONFSERVER-58208", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/CONFSERVER-58208"}, {"name": "https://jira.atlassian.com/browse/CWD-5362", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/CWD-5362"}, {"name": "https://jira.atlassian.com/browse/JRASERVER-68855", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/JRASERVER-68855"}]}}}}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2018-20239", "datePublished": "2019-04-29T00:00:00", "dateReserved": "2018-12-19T00:00:00", "dateUpdated": "2019-05-29T20:20:19", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", "matchCriteriaId": "2693A891-F156-4E34-B8FE-C5B50B3B4864", "versionEndExcluding": "5.0.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", "matchCriteriaId": "40944714-8855-458B-B776-0AF4E2AE7CDF", "versionEndExcluding": "5.2.10", "versionStartIncluding": "5.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4225CCB-FD35-4B93-BC1E-85F0E83383E0", "versionEndExcluding": "5.3.6", "versionStartIncluding": "5.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", "matchCriteriaId": "68F3DE59-0A8E-40F9-901D-F2D3C0EA546F", "versionEndExcluding": "5.4.12", "versionStartIncluding": "5.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5414E46-B9B0-4ABF-9DDF-C1EBB8E829AE", "versionEndExcluding": "6.0.4", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1777CAE-0B14-4AD2-873F-CF5D3A0B79E4", "versionEndExcluding": "6.15.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D64E9D0-0393-4871-AEE3-0D4CAD045EAE", "versionEndExcluding": "6.15.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF812D66-1379-4421-B192-21BF9F51C1EE", "versionEndExcluding": "3.4.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C140AB4-C751-4D25-B1E7-BC1729D25B4D", "versionEndExcluding": "4.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", "matchCriteriaId": "40DD6225-F761-4E32-B6E9-45A9C79D4AD2", "versionEndExcluding": "4.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "75BBC078-951C-4109-A8E5-F13DD36CE837", "versionEndExcluding": "7.13.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3A2B3FB-45D3-4DB2-B10C-68E827E72837", "versionEndExcluding": "8.1.0", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF7E474F-E673-4414-A534-8E709AC6CBFF", "versionEndExcluding": "7.13.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "660409CF-397F-4D27-A331-37414A5547E5", "versionEndExcluding": "8.1.0", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0."}, {"lang": "es", "value": "Application Links anterior a la versi\u00f3n 5.0.11, desde la versi\u00f3n 5.1.0 a la 5.2.10, desde la versi\u00f3n 5.3.0 a la 5.3.6, desde la versi\u00f3n 5.4.0 a la 5.4.12, y desde la versi\u00f3n 6.0.0 a la 6.0.4, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) en el par\u00e1metro applinkStartingUrl. El producto es usado como un complemento en varios productos de Atlassian donde se ven impactados los siguientes: Confluence anterior a la versi\u00f3n 6.15.2, Crucible before anterior a la versi\u00f3n 4.7.0, Crowd anterior a la versi\u00f3n 3.4.3, Fisheye anterior a la versi\u00f3n 4.7.0, Jira anterior a la versi\u00f3n 7.13.3 y versi\u00f3n 8.x anterior a 8.1.0."}], "id": "CVE-2018-20239", "lastModified": "2022-07-27T14:40:56.710", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-30T16:29:00.247", "references": [{"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://ecosystem.atlassian.net/browse/APL-1373"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CONFSERVER-58208"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CRUC-8379"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/CWD-5362"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/FE-7161"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JRASERVER-68855"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}