CVE:CVE-2018-20239
CNNVD:CNNVD-201904-1341
Atlassian Application Links是澳大利亚Atlassian公司的一款使用在Atlassian产品中用于创建连接到其他应用程序中的按钮的插件。
Application Links中存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。以下版本受到影响：Application Links 5.0.11之前版本，5.1.x版本，5.2.10之前的5.2.x版本，5.3.6之前的5.3.x版本，5.4.12之前的5.4.x版本，6.0.4之前的6.0.x版本。
solution:Upgrade atlassian application_links to a higher version than 5.0.11,5.2.10,5.3.6,5.4.12,6.0.4,and avoid the version (,5.0.11),[5.1.0,5.2.10),[5.3.0,5.3.6),[5.4.0,5.4.12),[6.0.0,6.0.4); Upgrade atlassian confluence_data_center to a higher version than 6.15.2,and avoid the version (,6.15.2); Upgrade atlassian confluence_server to a higher version than 6.15.2,and avoid the version (,6.15.2); Upgrade atlassian crowd to a higher version than 3.4.3,and avoid the version (,3.4.3); Upgrade atlassian crucible to a higher version than 4.7.0,and avoid the version (,4.7.0); Upgrade atlassian fisheye to a higher version than 4.7.0,and avoid the version (,4.7.0); Upgrade atlassian jira_data_center to a higher version than 7.13.3,8.1.0,and avoid the version (,7.13.3),[8.0.0,8.1.0); Upgrade atlassian jira_server to a higher version than 7.13.3,8.1.0,and avoid the version (,7.13.3),[8.0.0,8.1.0)