What is CVE-2019-14999?

CVE-2019-14999 is a medium-severity vulnerability in Atlassian Universal Plugin Manager, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2019-08-23.

How severe is CVE-2019-14999?

Medium severity. CVSS v3 base score is 4.3 out of 10.

CSRF in Atlassian Universal Plugin Manager

CVE-2019-14999

The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.006 (43.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Affected products

Atlassian Universal Plugin Manager — versions unspecified, 3.0.0, unspecified
Atlassian Universal_plugin_manager

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

security@atlassian.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2019-14999?: CVE-2019-14999 is a medium-severity vulnerability in Atlassian Universal Plugin Manager, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2019-08-23.
How severe is CVE-2019-14999?: Medium severity. CVSS v3 base score is 4.3 out of 10.