[CONFSERVER-39689] Rest API XSS - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 5.9.1, 5.8.17
Affects Version/s: 5.2, 5.8.14, 5.8.15
Component/s: Core - Content REST APIs
Labels:

Bug Fix Policy:
View Atlassian Server bug fix policy

An unauthenticated XSS vulnerability has been confirmed in confluence 5.8.15 and 5.8.14.

The vulnerability is located at /rest/prototype/1/session/check/something

POC URL:
http://<server>/conf_path/rest/prototype/1/session/check/something%3Cimg%20src%3da%20onerror%3dalert%280%29%3E

This was confirmed in the latest version of firefox.

incorporates

CONFSERVER-30792 Incorrect error message in session/check REST resource

Closed

included in

CPU-121 Confluence 6.0.0-OD-2015.49.1-0002

CPU-139 Confluence 6.0.0-OD-2015.49.1-0003

CPU-141 Confluence 6.0.0-OD-2015.50.1-0003

mentioned in: Page Failed to load; Page Loading...; Page Loading...; Page Loading...

(3 mentioned in)

Chii (Inactive) added a comment - 09/Feb/2016 12:38 AM

kschoenh: this is fixed in 5.9 as well.

Chii (Inactive) added a comment - 09/Feb/2016 12:38 AM kschoenh : this is fixed in 5.9 as well.

Kelly Schoenhofen added a comment - 08/Feb/2016 7:08 PM

Question, the fix version only says "5.8.17", which was GA on Nov 19th 2015. Confluence 5.9 was GA on Nov 24th, five days later. Can you confirm ~~CONF-39689~~/CVE-2015-8398 is fixed in 5.9.x?

Kelly Schoenhofen added a comment - 08/Feb/2016 7:08 PM Question, the fix version only says "5.8.17", which was GA on Nov 19th 2015. Confluence 5.9 was GA on Nov 24th, five days later. Can you confirm CONF-39689 /CVE-2015-8398 is fixed in 5.9.x?

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:29 AM

This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:29 AM This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:26 AM

This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:26 AM This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:23 AM

This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:23 AM This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:22 AM

This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:22 AM This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:19 AM

This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:19 AM This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:16 AM

This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:16 AM This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:14 AM

This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:14 AM This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:12 AM

This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Deleted Account (Inactive) added a comment - 02/Dec/2015 2:12 AM This issue is mentioned in release Confluence 6.0.0-OD-2015.50.1-0003 just promoted to jirastudio-prd-virtual

Assignee:: Minh Tran

Reporter:: Sebastian Perez

Affected customers:: 0 This affects my team

Watchers:: 8 Start watching this issue

Created:: 26/Oct/2015 8:04 PM

Updated:: 11/Oct/2018 8:56 AM

Resolved:: 16/Nov/2015 8:17 AM