CVE-2019-14999

Published: Aug 23, 2019Modified: Nov 21, 2024

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator.

Affected (3)

Products: Atlassian: Universal Plugin Manager

Atlassian

1 product

Universal Plugin Manager

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Atlassian Universal Plugin Manager	Before 2.22.19
Atlassian Universal Plugin Manager	From 3.0.0 to 3.0.3
Atlassian Universal Plugin Manager	From 4.0.0 to 4.0.3

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://ecosystem.atlassian.net/browse/UPM-6044

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://ecosystem.atlassian.net/browse/UPM-6044

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.