CVE-2018-20233
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.
- Score
- CVSS 3.0 6.5 Medium
- Status
- Modified - security@atlassian.com
- Published
- 2019-01-18
- Last modified
- 2024-09-16
- Weaknesses
- CWE-611
Affected products
References
- http://www.securityfocus.com/bid/106661
- https://ecosystem.atlassian.net/browse/UPM-5964
