CVE-2018-20239

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Atlassian Application Links	>= unspecified, < 5.0.11; >= 5.1.0, < unspecified; >= unspecified, < 5.2.10; >= 5.3.0, < unspecified; >= unspecified, < 5.3.6; >= 5.4.0, < unspecified; >= unspecified, < 5.4.12; >= 6.0.0, < unspecified; >= unspecified, < 6.0.4

References

https://ecosystem.atlassian.net/browse/APL-1373Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-58208Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CRUC-8379Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CWD-5362Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/FE-7161Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-68855Issue Tracking, Vendor Advisory
https://ecosystem.atlassian.net/browse/APL-1373Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-58208Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CRUC-8379Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CWD-5362Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/FE-7161Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-68855Issue Tracking, Vendor Advisory

Timeline

Published: Apr 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-20248.1IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified CVE-2018-202404.8The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary H CVE-2018-202415.4The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTM CVE-2018-202426.1A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijack CVE-2018-202437.5The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fi CVE-2018-202445.5In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrar CVE-2018-202457.5The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper chec CVE-2018-202477.8In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page tree CVE-2018-202489.8In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref table poi CVE-2018-202498.8In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing invalid xref entries u CVE-2018-20254.4IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CI CVE-2018-202507.8In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in