Atlassian · Confluence · CVE-2011-4822
**Name of the Vulnerable Software and Affected Versions**
Atlassian FishEye versions prior to 2.5.5
**Description**
The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the user profile feature. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via two main vectors: snippets in a user comment, which is not properly handled in a Confluence page, and the user profile display name, which is not properly handled in a FishEye page.
**Recommendations**
For versions prior to 2.5.5, update to version 2.5.5 or later to resolve the issue. As a temporary workaround, consider restricting user input for snippets in comments and user profile display names to minimize the risk of exploitation.