Atlassian Universal Plugin Manager vulnerabilities

3 CVEs affecting Atlassian Universal Plugin Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-14999, published 2019-08-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-20233, published 2019-01-18. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and…
CVE-2018-5229, published 2018-07-16. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting…
CVE-2019-14999, published 2019-08-23. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers…