Application Links before version 5.0.11, from version 5.1.0 prior to 5.2.10, from version 5.3.0 prior to 5.3.6, from version 5.4.0 prior to 5.4.12, and from version 6.0.0 prior to 6.0.4 allows remote malicious users to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x prior to 8.1.0.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
atlassian application links |
||
atlassian fisheye |
||
atlassian crucible |
||
atlassian jira server |
||
atlassian jira data center |
||
atlassian confluence data center |
||
atlassian confluence server |
||
atlassian crowd |
Vulmon