CVE-2017-16856: XSS
First published: Tue Dec 05 2017(Updated: )
The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Confluence | <6.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2017-16856?
CVE-2017-16856 is a vulnerability in Atlassian Confluence before version 6.5.2 that allows remote attackers to inject arbitrary HTML or JavaScript via cross-site scripting (XSS) vulnerabilities.
How does CVE-2017-16856 affect Atlassian Confluence?
CVE-2017-16856 affects Atlassian Confluence before version 6.5.2.
What is the severity of CVE-2017-16856?
CVE-2017-16856 has a severity keyword of 'medium' and a severity value of 6.1.
How can remote attackers exploit CVE-2017-16856?
Remote attackers can exploit CVE-2017-16856 by injecting arbitrary HTML or JavaScript via cross-site scripting (XSS) vulnerabilities in various RSS properties.
Are there any references available for CVE-2017-16856?
Yes, you can find more information about CVE-2017-16856 at the following sources: [1] http://www.securityfocus.com/bid/102094, [2] https://jira.atlassian.com/browse/CONFSERVER-54395
- collector/nvd-index
- vendor/atlassian
- canonical/atlassian confluence