Skip to main content

User Management CVE-2023-36662

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2023-06-26 cve@mitre.org
XSS Atlassian User Management
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 26, 2023 - 01:15 nvd
MEDIUM 5.4

DescriptionNVD

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24.

AnalysisAI

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24. Affected products include: Techtime User Management. Version information: through 2.17.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

More in User Management

View all
CVE-2022-21500 HIGH POC
7.5 May 20

Vulnerability in Oracle E-Business Suite (component: Manage Proxies). Rated high severity (CVSS 7.5), this vulnerability
CVE-2018-18419 MEDIUM POC
5.4 Oct 19

Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filen
CVE-2025-30708 HIGH
7.5 Apr 15

Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Search and Register Users). R
CVE-2018-3236 MEDIUM
6.5 Oct 17

Vulnerability in the Oracle User Management component of Oracle E-Business Suite (subcomponent: Reports). Rated medium s
CVE-2018-2691 MEDIUM
5.4 Jan 18

Vulnerability in the Oracle User Management component of Oracle E-Business Suite (subcomponent: Proxy User Delegation).

CVE-2026-12097 MEDIUM
5.3 Jul 08

Authorization bypass in the User Management WordPress plugin (versions ≤ 1.2) permits unauthenticated network attackers

CVE-2023-21997 MEDIUM
4.3 Apr 18

Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). Rated
CVE-2021-2017 MEDIUM
4.3 Jan 20

Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). Rated

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2023-36662 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy