Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 6.5.2
Affects Version/s: 6.4.1
Component/s: Macros - Other Macros
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.

Acknowledgements

Atlassian would like to credit Glenn 'devalias' Grant (http://devalias.net) of TSS (https://dtss.com.au) for reporting this issue to us.

Attachments

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 9 Start watching this issue

Dates

Created:: 05/Dec/2017 4:13 AM

Updated:: 09/Feb/2020 10:20 PM

Resolved:: 05/Dec/2017 4:30 AM