Medium severity · published Aug 23, 2019
CVE-2019-14999
The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3…
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UP
Universal Plugin Manager · Atlassian
before 2.22.19; 3.0.0 before 3.0.3; 4.0.0 before 4.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14999
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14999
Issue Tracking
https://ecosystem.atlassian.net/browse/UPM-6044
More from Universal Plugin Manager
6.5
CVE-2018-20233
The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make…
5.4
CVE-2018-5229
The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a…