Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-17165

Links from indexbrowser.jsp are vulnerable to XSS attacks

XMLWordPrintable

      CONF-16888 has introduced or re-introduced an XSS vulnerability.

      To reproduce:

      • Create a new user, and for the Full Name use: 
        <script>alert('Vulnerable')</script>
      • Go to ../admin/indexbrowser.jsp and find the entry
      • Click on the entry, and the script is executed.

      This also happens for other content types.

        1. viewdocument.jsp
          2 kB
          Anatoli

            [CONFSERVER-17165] Links from indexbrowser.jsp are vulnerable to XSS attacks

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2894414 ] New: CONFSERVER Bug Workflow v4 [ 2986997 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2778810 ] New: JAC Bug Workflow v3 [ 2894414 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2718581 ] New: JAC Bug Workflow v2 [ 2778810 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2382690 ] New: JAC Bug Workflow [ 2718581 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2275713 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2382690 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2218329 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2275713 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2172291 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2218329 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1934262 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2172291 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v3 [ 1733817 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 1934262 ]
            Katherine Yabut made changes -
            Workflow Original: CONF Bug Subtask WF (TEMP) [ 1692349 ] New: Confluence Workflow - Public Facing - Restricted v3 [ 1733817 ]

              akazatchkov Anatoli
              mhrynczak Mark Hrynczak (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: