PT-2017-14601 · Atlassian · Confluence

Devalias + 1 · Published 2017-12-05 · Updated 2017-12-19 · CVE-2017-16856

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Confluence versions prior to 6.5.2

Description The issue concerns a cross-site scripting (XSS) vulnerability in the RSS Feed macro of Atlassian Confluence. This vulnerability allows remote attackers to inject arbitrary HTML or JavaScript code via various RSS properties that are used as links without proper restrictions on their scheme.

Recommendations For versions prior to 6.5.2, update to version 6.5.2 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16856

Affected Products

Confluence

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-16856 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16856 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16856 · Security Note
• https://jira.atlassian.com/browse/CONFSERVER-54395 · Vendor Advisory
• http://securityfocus.com/bid/102094 · Note