Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-39689

Rest API XSS

XMLWordPrintable

      An unauthenticated XSS vulnerability has been confirmed in confluence 5.8.15 and 5.8.14.

      The vulnerability is located at /rest/prototype/1/session/check/something

      POC URL:
      http://<server>/conf_path/rest/prototype/1/session/check/something%3Cimg%20src%3da%20onerror%3dalert%280%29%3E

      This was confirmed in the latest version of firefox.

              mtran@atlassian.com Minh Tran
              fa1767dc8cc8 Sebastian Perez
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: