• Type: Bug
• Resolution: Fixed
• Priority: Highest
• Fix Version/s: 3.4.5
• Affects Version/s: 2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 3.3, 3.4
• Component/s: None
• Labels:

  • affects-server
  • editor
  • security

1. confluence-dashboard-macros-1.13.1.jar

   07/Dec/2010 5:52 AM

   43 kB

   Matthew Erickson

2. confluence-dashboard-macros-3.4.4.jar

   11/Jan/2011 4:38 AM

   47 kB

   Stefan Saasen

[CONFSERVER-21394] XSS vulnerability in Create Space Button macro

Collapse comment: VitalyA added a comment - 30/Jan/2011 11:57 PM

VitalyA added a comment - 30/Jan/2011 11:57 PM

Please note that we have released multiple advisories about Confluence 3.2 or later, the earliest advisory - http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2010-05-04. We recommend that you review them and decide whether you can upgrade to a more recent version of the product or apply external security controls if you cannot. Most of the vulnerabilities are not critical and often present less risk when used in a corporate environment with no access from the Internet.

We usually provide patches only for critical severity (= really bad) vulnerabilities as a stop-gap measure until you can upgrade, and you should not expect that you can continue patching your system instead of upgrading. Our patches are often non-cumulative - we do not recommend that you apply multiple patches from different advisories on top of each other, but strongly recommend to upgrade to the most recent version regularly.

Expand comment: VitalyA added a comment - 30/Jan/2011 11:57 PM

VitalyA added a comment - 30/Jan/2011 11:57 PM Please note that we have released multiple advisories about Confluence 3.2 or later, the earliest advisory - http://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+2010-05-04 . We recommend that you review them and decide whether you can upgrade to a more recent version of the product or apply external security controls if you cannot. Most of the vulnerabilities are not critical and often present less risk when used in a corporate environment with no access from the Internet. We usually provide patches only for critical severity (= really bad) vulnerabilities as a stop-gap measure until you can upgrade, and you should not expect that you can continue patching your system instead of upgrading. Our patches are often non-cumulative - we do not recommend that you apply multiple patches from different advisories on top of each other, but strongly recommend to upgrade to the most recent version regularly.

Collapse comment: Jeff Kirby added a comment - 25/Jan/2011 9:57 PM

Jeff Kirby added a comment - 25/Jan/2011 9:57 PM

I'm confused because the plugin exchange site lists 1.14 as the latest version available for the Dashboard Macros Plugin. Does 1.13.1 supercede version 1.14?
https://studio.plugins.atlassian.com/wiki/display/DASHMACROS/Confluence+Dashboard+Macros

Expand comment: Jeff Kirby added a comment - 25/Jan/2011 9:57 PM

Jeff Kirby added a comment - 25/Jan/2011 9:57 PM I'm confused because the plugin exchange site lists 1.14 as the latest version available for the Dashboard Macros Plugin. Does 1.13.1 supercede version 1.14? https://studio.plugins.atlassian.com/wiki/display/DASHMACROS/Confluence+Dashboard+Macros

Collapse comment: Dave added a comment - 21/Jan/2011 5:49 AM

Dave added a comment - 21/Jan/2011 5:49 AM

Will we get a separate fix for 3.2 or the current fix can be used?

Expand comment: Dave added a comment - 21/Jan/2011 5:49 AM

Dave added a comment - 21/Jan/2011 5:49 AM Will we get a separate fix for 3.2 or the current fix can be used?

Collapse comment: HengHwa Loi [Atlassian] added a comment - 19/Jan/2011 2:52 PM, Edited by HengHwa Loi [Atlassian] - 19/Jan/2011 2:53 PM

HengHwa Loi [Atlassian] added a comment - 19/Jan/2011 2:52 PM - edited

Tested 3.4.4 on Confluence 3.1.2, the following error occurs in the Dashboard:

Error formatting macro: spaces: java.lang.NoSuchMethodError: com.atlassian.confluence.labels.LabelManager.getTeamLabelsForSpaces(Ljava/util/Collection;)Ljava/util/List;

Plus the Dashboard does not rendered properly.

Expand comment: HengHwa Loi [Atlassian] added a comment - 19/Jan/2011 2:52 PM, Edited by HengHwa Loi [Atlassian] - 19/Jan/2011 2:53 PM

HengHwa Loi [Atlassian] added a comment - 19/Jan/2011 2:52 PM - edited Tested 3.4.4 on Confluence 3.1.2, the following error occurs in the Dashboard: Error formatting macro: spaces: java.lang.NoSuchMethodError: com.atlassian.confluence.labels.LabelManager.getTeamLabelsForSpaces(Ljava/util/Collection;)Ljava/util/List; Plus the Dashboard does not rendered properly.

Collapse comment: Stefan Saasen (Inactive) added a comment - 11/Jan/2011 4:38 AM

Stefan Saasen (Inactive) added a comment - 11/Jan/2011 4:38 AM

I have attached version 3.4.4 of the Confluence Dashboard Macros plugin which contains the fix for this issue, and has been tested to work with Confluence 3.4.x.

Expand comment: Stefan Saasen (Inactive) added a comment - 11/Jan/2011 4:38 AM

Stefan Saasen (Inactive) added a comment - 11/Jan/2011 4:38 AM I have attached version 3.4.4 of the Confluence Dashboard Macros plugin which contains the fix for this issue, and has been tested to work with Confluence 3.4.x.

Collapse comment: Matthew Erickson added a comment - 07/Dec/2010 5:52 AM, Edited by Stefan Saasen - 11/Jan/2011 4:39 AM

Matthew Erickson added a comment - 07/Dec/2010 5:52 AM - edited

I have attached version 1.13.1 of the Confluence Dashboard Macros plugin which contains the fix for this issue, and has been tested to work with Confluence 3.3.x.

Expand comment: Matthew Erickson added a comment - 07/Dec/2010 5:52 AM, Edited by Stefan Saasen - 11/Jan/2011 4:39 AM

Matthew Erickson added a comment - 07/Dec/2010 5:52 AM - edited I have attached version 1.13.1 of the Confluence Dashboard Macros plugin which contains the fix for this issue, and has been tested to work with Confluence 3.3.x.