« Volver al listado

CVE-2019-14999

Estado: ModificadaMedia (4.3)—

The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Atlassian — Universal Plugin Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-14999",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Universal Plugin Manager",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.22.19",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "3.0.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "4.0.3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-23T14:15:11.670",
  "references": [
    {
      "url": "https://ecosystem.atlassian.net/browse/UPM-6044",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://ecosystem.atlassian.net/browse/UPM-6044",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator."
    },
    {
      "lang": "es",
      "value": "El punto final REST de desinstalación en Atlassian Universal Plugin Manager antes de la versión 2.22.19, de la versión 3.0.0 antes de la versión 3.0.3 y de la versión 4.0.0 antes de la versión 4.0.3 permite a los atacantes remotos desinstalar complementos utilizando una falsificación de solicitud entre sitios ( CSRF) vulnerabilidad en un administrador autenticado."
    }
  ],
  "lastModified": "2026-06-17T02:19:28.473",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:universal_plugin_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "121AEF1B-E092-453B-AD35-5FC946021A3B",
              "versionEndExcluding": "2.22.19"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:universal_plugin_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B381C60-6F2D-47A3-8A80-92188DC02F78",
              "versionEndExcluding": "3.0.3",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:universal_plugin_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B633550-159E-465F-95D4-5085B9C461E9",
              "versionEndExcluding": "4.0.3",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}