CVE-2018-20233

6.5 mediumEPSS 1.8%

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.

Severity

CVSS 3.0

6.5 medium

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2019-01-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:universal_plugin_manager

References

http://www.securityfocus.com/bid/106661
https://ecosystem.atlassian.net/browse/UPM-5964
http://www.securityfocus.com/bid/106661
https://ecosystem.atlassian.net/browse/UPM-5964

Check your stack JSON