VulnerabilityModified

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page.

MEDIUM 5.4EPSS 0.34%

Does this matter?

Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.

Description

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.34% probability · 28th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: techtime/user management
Source: cve@mitre.org

References

https://techtime.co.nz/display/TECHTIME/Security+Vulnerability+Affecting+User+ManagementVendor Advisory
https://techtime.co.nz/display/TECHTIME/Security+Vulnerability+Affecting+User+ManagementVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.