Atlassian Application Links vulnerabilities

7 CVEs affecting Atlassian Application Links, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-20105, published 2020-03-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-20239, published 2019-04-30. Medium severity, CVSS 5.4. EPSS: 3.3% chance of exploitation in the next 30 days. Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote…
CVE-2017-18111, published 2019-03-29. High severity, CVSS 8.7. EPSS: 1.6% chance of exploitation in the next 30 days. The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was…
CVE-2019-20105, published 2020-03-17. Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days. The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0…
CVE-2017-18096, published 2018-04-04. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access…
CVE-2019-15011, published 2019-12-17. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13,…
CVE-2017-16860, published 2018-05-14. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to…
CVE-2018-5227, published 2018-04-10. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a…