CVE-2019-14999

MEDIUM 4.3CVE-2019-14999 · Published 23/08/2019 · updated 17/06/2026

In short

CVE-2019-14999 is a MEDIUM (CVSS 4.3) vulnerability affecting universal plugin manager (atlassian).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.4% of all vulnerabilities.
Fix: update to 3.0.3, 4.0.3, 2.22.19 or later.

Package	Affected versions	Patched versions
universal plugin manager atlassian	`≥ 3.0.0, < 3.0.3≥ 4.0.0, < 4.0.3< 2.22.19`	`3.0.34.0.32.22.19`

Description

The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator.

References

ecosystem.atlassian.net/browse/UPM-6044 · Issue Tracking

More vulnerabilities in universal plugin manager

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free