Read the docs
TI-2018-14346 Aliases CVE-2018-20239GHSA-778g-4c8j-829w

Cross-site scripting in Atlassian Application Links

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.

Why it matters now

EPSS 0.03339 88th percentileScored 2026-11-07
Fix Fixed Atlassian Application Links (Atlassian): 5.0.11, 5.2.10, 5.3.6 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianAtlassian Application Linksbefore 5.0.11; 5.1.0 and later; before 5.2.10; 5.3.0 and later; before 5.3.6; 5.4.0 and later; before 5.4.12; 6.0.0 and later; before 6.0.45.0.11, 5.2.10, 5.3.6, 5.4.12, 6.0.4Patch availableCNA
  • Atlassian Application Links VendorAtlassian Affected before 5.0.11; 5.1.0 and later; before 5.2.10; 5.3.0 and later; before 5.3.6; 5.4.0 and later; before 5.4.12; 6.0.0 and later; before 6.0.4 Fixed in 5.0.11, 5.2.10, 5.3.6, 5.4.12, 6.0.4 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:*before 5.0.11; 5.1.0 to before 5.2.10; 5.3.0 to before 5.3.6; 5.4.0 to before 5.4.12; 6.0.0 to before 6.0.4VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*before 6.15.2VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*before 6.15.2VulnerableAtlassian
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*before 3.4.3VulnerableAtlassian
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*before 4.7.0VulnerableAtlassian
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*before 4.7.0VulnerableAtlassian
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*before 7.13.3; 8.0.0 to before 8.1.0VulnerableAtlassian
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*before 7.13.3; 8.0.0 to before 8.1.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:application_links:*:*:*:*:*:*:*:* Versions before 5.0.11; 5.1.0 to before 5.2.10; 5.3.0 to before 5.3.6; 5.4.0 to before 5.4.12; 6.0.0 to before 6.0.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions before 6.15.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions before 6.15.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions before 3.4.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:* Versions before 4.7.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:* Versions before 4.7.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions before 7.13.3; 8.0.0 to before 8.1.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions before 7.13.3; 8.0.0 to before 8.1.0 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Atlassian Application Links (Atlassian) Fixed in 5.0.11, 5.2.10, 5.3.6, 5.4.12, 6.0.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20239
  2. 2026-10-03 Alias added: GHSA-778g-4c8j-829w

References

Advisory 6

  • TI-2017-13318 XML external entity injection in Atlassian Application Links CVSS 3.0HIGH 8.7
  • TI-2017-13304 Server-side request forgery in Atlassian Application Links CVSS 3.0HIGH 7.2
  • TI-2017-12406 Cross-site scripting in Atlassian Application Links CVSS 3.0MEDIUM 6.1
  • TI-2019-14513 Missing authentication in Atlassian Application Links CVSS 3.1MEDIUM 4.9
  • TI-2018-03784 Cross-site scripting in Atlassian Application Links CVSS 3.0MEDIUM 4.8
  • TI-2019-11197 Incorrect default permissions in Atlassian Application Links CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences