CVE-2023-36662
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira versions 2.0.0 through 2.17.1, User Management for Confluence versions 2.0.0 through 2.15.24, and User Management for Bitbucket versions 2.2.2 through 2.15.24.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking. Organizations should be aware of the security risks associated with user data.
Recommendation
It is recommended to update the user management components to the latest versions that address this vulnerability. A security audit of the application should also be conducted to identify potential threats.
Original NVD description (English source)
The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24.