XML External Entity (XXE) Vulnerability in Atlassian Universal Plugin Manager

CVE-2018-20233 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:N/A:P

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.

Learn more about our External Network Penetration Testing.