Vulnerabilities > CVE-2018-20233 - XXE vulnerability in Atlassian Universal Plugin Manager

CVSS 5.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

atlassian

CWE-611

NVD

Published: 2019-01-18

Updated: 2019-02-06

Summary

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.

Vulnerable Configurations

Part	Description	Count
Application	Atlassian Atlassian Universal Plugin Manager 1.0 Atlassian Universal Plugin Manager 1.0.1 Atlassian Universal Plugin Manager 1.1.1 Atlassian Universal Plugin Manager 1.1.2 Atlassian Universal Plugin Manager 1.1.3 Atlassian Universal Plugin Manager 1.1.4 Atlassian Universal Plugin Manager 1.3.1 Atlassian Universal Plugin Manager 1.3.2 Atlassian Universal Plugin Manager 1.4 Atlassian Universal Plugin Manager 1.5 Atlassian Universal Plugin Manager 1.6.1 Atlassian Universal Plugin Manager 1.6.2 Atlassian Universal Plugin Manager 1.6.3 Atlassian Universal Plugin Manager 1.6.4 Atlassian Universal Plugin Manager 2.0 Atlassian Universal Plugin Manager 2.0.2 Atlassian Universal Plugin Manager 2.0.3 Atlassian Universal Plugin Manager 2.0.4 Atlassian Universal Plugin Manager 2.0.5 Atlassian Universal Plugin Manager 2.0.6 Atlassian Universal Plugin Manager 2.1 Atlassian Universal Plugin Manager 2.1.1 Atlassian Universal Plugin Manager 2.1.2 Atlassian Universal Plugin Manager 2.1.3 Atlassian Universal Plugin Manager 2.1.4 Atlassian Universal Plugin Manager 2.1.5 Atlassian Universal Plugin Manager 2.2 Atlassian Universal Plugin Manager 2.2.2 Atlassian Universal Plugin Manager 2.2.3 Atlassian Universal Plugin Manager 2.2.4 Atlassian Universal Plugin Manager 2.3 Atlassian Universal Plugin Manager 2.3.1 Atlassian Universal Plugin Manager 2.3.2 Atlassian Universal Plugin Manager 2.4 Atlassian Universal Plugin Manager 2.4.1 Atlassian Universal Plugin Manager 2.4.2 Atlassian Universal Plugin Manager 2.4.3 Atlassian Universal Plugin Manager 2.5 Atlassian Universal Plugin Manager 2.5.1 Atlassian Universal Plugin Manager 2.5.2 Atlassian Universal Plugin Manager 2.6 Atlassian Universal Plugin Manager 2.6.1 Atlassian Universal Plugin Manager 2.7.2 Atlassian Universal Plugin Manager 2.7.3 Atlassian Universal Plugin Manager 2.7.4 Atlassian Universal Plugin Manager 2.7.6 Atlassian Universal Plugin Manager 2.7.7 Atlassian Universal Plugin Manager 2.7.10 Atlassian Universal Plugin Manager 2.8 Atlassian Universal Plugin Manager 2.8.1 Atlassian Universal Plugin Manager 2.8.2 Atlassian Universal Plugin Manager 2.9 Atlassian Universal Plugin Manager 2.9.1 Atlassian Universal Plugin Manager 2.9.3 Atlassian Universal Plugin Manager 2.10 Atlassian Universal Plugin Manager 2.10.1 Atlassian Universal Plugin Manager 2.10.2 Atlassian Universal Plugin Manager 2.11 Atlassian Universal Plugin Manager 2.12 Atlassian Universal Plugin Manager 2.12.1 Atlassian Universal Plugin Manager 2.12.2 Atlassian Universal Plugin Manager 2.12.3 Atlassian Universal Plugin Manager 2.12.4 Atlassian Universal Plugin Manager 2.13.3 Atlassian Universal Plugin Manager 2.14 Atlassian Universal Plugin Manager 2.14.1 Atlassian Universal Plugin Manager 2.14.2 Atlassian Universal Plugin Manager 2.14.3 Atlassian Universal Plugin Manager 2.14.4 Atlassian Universal Plugin Manager 2.14.5 Atlassian Universal Plugin Manager 2.15 Atlassian Universal Plugin Manager 2.15.1 Atlassian Universal Plugin Manager 2.15.2 Atlassian Universal Plugin Manager 2.15.3 Atlassian Universal Plugin Manager 2.16 Atlassian Universal Plugin Manager 2.16.1 Atlassian Universal Plugin Manager 2.16.2 Atlassian Universal Plugin Manager 2.16.3 Atlassian Universal Plugin Manager 2.16.4 Atlassian Universal Plugin Manager 2.16.5 Atlassian Universal Plugin Manager 2.17 Atlassian Universal Plugin Manager 2.17.4 Atlassian Universal Plugin Manager 2.17.5 Atlassian Universal Plugin Manager 2.17.6 Atlassian Universal Plugin Manager 2.17.7 Atlassian Universal Plugin Manager 2.17.8 Atlassian Universal Plugin Manager 2.17.10 Atlassian Universal Plugin Manager 2.17.11 Atlassian Universal Plugin Manager 2.17.13 Atlassian Universal Plugin Manager 2.17.14 Atlassian Universal Plugin Manager 2.17.15 Atlassian Universal Plugin Manager 2.17.17 Atlassian Universal Plugin Manager 2.18 Atlassian Universal Plugin Manager 2.18.1 Atlassian Universal Plugin Manager 2.18.2 Atlassian Universal Plugin Manager 2.18.4 Atlassian Universal Plugin Manager 2.18.5 Atlassian Universal Plugin Manager 2.19.1 Atlassian Universal Plugin Manager 2.19.2 Atlassian Universal Plugin Manager 2.19.3 Atlassian Universal Plugin Manager 2.19.4 Atlassian Universal Plugin Manager 2.19.6 Atlassian Universal Plugin Manager 2.20 Atlassian Universal Plugin Manager 2.20.1 Atlassian Universal Plugin Manager 2.20.2 Atlassian Universal Plugin Manager 2.20.3 Atlassian Universal Plugin Manager 2.20.4 Atlassian Universal Plugin Manager 2.20.5 Atlassian Universal Plugin Manager 2.20.6 Atlassian Universal Plugin Manager 2.20.7 Atlassian Universal Plugin Manager 2.21 Atlassian Universal Plugin Manager 2.21.2 Atlassian Universal Plugin Manager 2.21.3 Atlassian Universal Plugin Manager 2.21.4 Atlassian Universal Plugin Manager 2.21.5 Atlassian Universal Plugin Manager 2.22 Atlassian Universal Plugin Manager 2.22.2 Atlassian Universal Plugin Manager 2.22.3 Atlassian Universal Plugin Manager 2.22.4 Atlassian Universal Plugin Manager 2.22.5 Atlassian Universal Plugin Manager 2.22.6 Atlassian Universal Plugin Manager 2.22.8 Atlassian Universal Plugin Manager 2.22.9 Atlassian Universal Plugin Manager 2.22.10 Atlassian Universal Plugin Manager 2.22.11 Atlassian Universal Plugin Manager 2.22.12	126

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References