Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-21508

XSS vulnerability in Documentation Link macro

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: High High
    • 3.4.6
    • 2.7
    • None

      We have identified and fixed a cross-site scripting (XSS) vulnerability in the Confluence

      {doc}

      macro.

      XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a Confluence page. You can read more about XSS attacks at various places on the web, including these:

      This issue is reported in our security advisory on this page:
      http://confluence.atlassian.com/x/HgdrDQ

        1. confluence-advanced-macros-1.12.3.jar
          196 kB
        2. confluence-advanced-macros-1.9.2.jar
          196 kB

            [CONFSERVER-21508] XSS vulnerability in Documentation Link macro

            VitalyA added a comment -

            Please note that we have released multiple advisories about Confluence 3.2 or later, the earliest advisory - http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2010-05-04. We recommend that you review them and decide whether you can upgrade to a more recent version of the product or apply external security controls if you cannot. Most of the vulnerabilities are not critical and often present less risk when used in a corporate environment with no access from the Internet.

            We usually provide patches only for critical severity (= really bad) vulnerabilities as a stop-gap measure until you can upgrade, and you should not expect that you can continue patching your system instead of upgrading. Our patches are often non-cumulative - we do not recommend that you apply multiple patches from different advisories on top of each other, but strongly recommend to upgrade to the most recent version regularly.

            VitalyA added a comment - Please note that we have released multiple advisories about Confluence 3.2 or later, the earliest advisory - http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2010-05-04 . We recommend that you review them and decide whether you can upgrade to a more recent version of the product or apply external security controls if you cannot. Most of the vulnerabilities are not critical and often present less risk when used in a corporate environment with no access from the Internet. We usually provide patches only for critical severity (= really bad) vulnerabilities as a stop-gap measure until you can upgrade, and you should not expect that you can continue patching your system instead of upgrading. Our patches are often non-cumulative - we do not recommend that you apply multiple patches from different advisories on top of each other, but strongly recommend to upgrade to the most recent version regularly.

            Dave added a comment -

            Will we get a separate fix for 3.2 or the current fix can be used?

            Dave added a comment - Will we get a separate fix for 3.2 or the current fix can be used?

            HengHwa Loi [Atlassian] added a comment -

            Tested 1.9.2 on 3.1.2, it works!!

            HengHwa Loi [Atlassian] added a comment - Tested 1.9.2 on 3.1.2, it works!!

            VitalyA added a comment -

            Atlassian thanks daveb for reporting this vulnerability.

            VitalyA added a comment - Atlassian thanks daveb for reporting this vulnerability.

            Stefan Saasen (Inactive) added a comment -

            I have attached version 1.9.2 of the Advanced Macros plugin which fixes this issue, and has been tested to work with Confluence 3.3.x.

            Stefan Saasen (Inactive) added a comment - I have attached version 1.9.2 of the Advanced Macros plugin which fixes this issue, and has been tested to work with Confluence 3.3.x.

            Stefan Saasen (Inactive) added a comment - - edited

            I have attached version 1.12.3 of the Advanced Macros Plugin that fixes this issue. It has been tested to be compatible with Confluence 3.4 and newer.

            Stefan Saasen (Inactive) added a comment - - edited I have attached version 1.12.3 of the Advanced Macros Plugin that fixes this issue. It has been tested to be compatible with Confluence 3.4 and newer.

              Unassigned Unassigned
              smaddox SarahA
              Affected customers:
              0 This affects my team
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: