Description

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.

Remediation

References

CVE-2017-16856

Related Vulnerabilities

WordPress Plugin OPS Old Post Spinner 'ops_file' Parameter Local File Include (2.2.1)

Liferay Portal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-42122)

Grafana Improper Authentication Vulnerability (CVE-2021-28148)

WordPress Plugin W3SCloud Contact Form 7 to Zoho CRM Cross-Site Scripting (1.1.2)

WordPress Plugin WPJobBoard Cross-Site Scripting (5.6.4)

Severity

Medium

Classification

CVE-2017-16856 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Tags

Missing Update Known Vulnerabilities