CVE-2018-5227

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the display url of a configured application link.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Atlassian Application Links	>= unspecified, < 5.4.4

References

http://www.securityfocus.com/bid/103731Third Party Advisory, VDB Entry
https://ecosystem.atlassian.net/browse/APL-1361Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/103731Third Party Advisory, VDB Entry
https://ecosystem.atlassian.net/browse/APL-1361Issue Tracking, Vendor Advisory

Timeline

Published: Apr 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-52286.1The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScr CVE-2018-52295.4The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to injec CVE-2018-52306.1The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 CVE-2018-52317.5The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before v CVE-2018-52326.1The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to i CVE-2018-52336.1Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject CVE-2018-52348.0The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in which the goal is execut CVE-2018-52356.0Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an CVE-2018-52365.3Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition (or race hazard). This type of issu CVE-2018-52378.8Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 could be susceptible to a privilege escalation vulnerability, which is a t CVE-2018-52387.8Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a type CVE-2018-52396.2Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to