CVE-2018-20239

Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.

• CWE-79

• https://ecosystem.atlassian.net/browse/APL-1373Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-58208Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/CRUC-8379Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/CWD-5362Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/FE-7161Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-68855Issue Tracking, Vendor Advisory
• https://ecosystem.atlassian.net/browse/APL-1373Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-58208Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/CRUC-8379Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/CWD-5362Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/FE-7161Issue Tracking, Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-68855Issue Tracking, Vendor Advisory

Published

Apr 30, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20233The Upload add-on resource in Atlassian Universal Plugin Man…
• CVE-2018-20234There was an argument injection vulnerability in Atlassian S…
• CVE-2018-20235There was an argument injection vulnerability in Atlassian S…
• CVE-2018-20236There was an command injection vulnerability in Sourcetree f…
• CVE-2018-20237Atlassian Confluence Server and Data Center before version 6…6.5
• CVE-2018-20238Various rest resources in Atlassian Crowd before version 3.2…
• CVE-2018-2024IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a secu…8.1
• CVE-2018-20240The administrative linker functionality in Atlassian Fisheye…
• CVE-2018-20241The Edit upload resource for a review in Atlassian Fisheye a…
• CVE-2018-20242A carefully crafted URL could trigger an XSS vulnerability o…
• CVE-2018-20243The implementation of POST with the username and password in…7.5
• CVE-2018-20244In Apache Airflow before 1.10.2, a malicious admin user coul…