Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-46695

XSS Vulnerability in About Me field

XMLWordPrintable

      NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.

      Steps to reproduce:

      In id.atlassian.com, add to your About me:

      <script>console.log(' +++++ Hi Dennis ++++++');</script>

      Save & check in your answers profile - the JS will appear in the browser console.

      jclark@atlassian.com can you do me a favor and give every profile field an once-over?

          Form Name

            [CONFSERVER-46695] XSS Vulnerability in About Me field

            Joe Clark added a comment - - edited

            I've confirmed that the "about me" field is the only user profile field that is displayed with django's default HTML escaping disabled.

            Joe Clark added a comment - - edited I've confirmed that the "about me" field is the only user profile field that is displayed with django's default HTML escaping disabled.

              jclark@atlassian.com Joe Clark
              dmeer Dennis Kromhout van der Meer (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: