description: The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.
problem types: Improper Restriction of XML External Entity Reference ('XXE')
affected:
{
product: Universal Plugin Manager
vendor: Atlassian
versions:
lessThan: 2.22.14, status: affected, version: unspecified, versionType: custom
}