Medium severity5.4NVD Advisory· Published Jul 16, 2018· Updated Jun 17, 2026

CVE-2018-5229

Description

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of user submitted add-on names.

Affected products

Atlassian/Universal Plugin Managerllm-fuzzy2 versions
<2.22.9+ 1 more
- (no CPE)range: <2.22.9
- (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

ecosystem.atlassian.net/browse/UPM-5871nvdIssue TrackingPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000