VulnerabilityModified
CVE-2018-5227
Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the display…
MEDIUM 4.8EPSS 0.61%
Does this matter?
Lower severity and a low EPSS score (0.61%). Track it; it rarely justifies an emergency change on its own.
Description
Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the display url of a configured application link.
- CVSS 3.0
- 4.8 MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.61% probability · 47th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- atlassian/application links
- Source
- security@atlassian.com
References
- http://www.securityfocus.com/bid/103731Third Party Advisory, VDB Entry
- https://ecosystem.atlassian.net/browse/APL-1361Issue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/103731Third Party Advisory, VDB Entry
- https://ecosystem.atlassian.net/browse/APL-1361Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.