• Type: Bug
• Resolution: Fixed
• Priority: Medium
• Fix Version/s: 2.8.1
• Affects Version/s: 2.8
• Component/s: None
• Labels:

  • affects-server
  • security

1. PageInfoAction.class

   9 kB

   05/May/2008 1:01 AM

2. viewinfo.vm

   24 kB

   05/May/2008 1:27 AM

[CONFSERVER-11524] XSS vulnerability in viewinfo.action

Collapse comment: Anatoli added a comment - 09/May/2008 4:32 AM

Anatoli added a comment - 09/May/2008 4:32 AM

It is possible to remove a referrer under Administration Console - > Manage Referrers by purging referrers with a particular prefix.
It is also possible not to show referrers in page info by disabling it under Administration Console - > Manage Referrers

Expand comment: Anatoli added a comment - 09/May/2008 4:32 AM

Anatoli added a comment - 09/May/2008 4:32 AM It is possible to remove a referrer under Administration Console - > Manage Referrers by purging referrers with a particular prefix. It is also possible not to show referrers in page info by disabling it under Administration Console - > Manage Referrers

Collapse comment: Anatoli added a comment - 05/May/2008 1:38 AM

Anatoli added a comment - 05/May/2008 1:38 AM

Patch Instructions for 2.7.x and 2.8.0 users

1. Shutdown Confluence
2. Create the following directories com/atlassian/confluence/pages/actions in your confluence/WEB-INF/classes directory.
3. Copy the attached PageInfoAction.class to confluence/WEB-INF/classes/com/atlassian/confluence/pages/actions
4. Copy the attached viewinfo.vm to confluence/pages
5. Startup Confluence

Expand comment: Anatoli added a comment - 05/May/2008 1:38 AM

Anatoli added a comment - 05/May/2008 1:38 AM Patch Instructions for 2.7.x and 2.8.0 users Shutdown Confluence Create the following directories com/atlassian/confluence/pages/actions in your confluence/WEB-INF/classes directory. Copy the attached PageInfoAction.class to confluence/WEB-INF/classes/com/atlassian/confluence/pages/actions Copy the attached viewinfo.vm to confluence/pages Startup Confluence