CVE-2017-16856: XSS
The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-16856?
CVE-2017-16856 is a vulnerability in Atlassian Confluence before version 6.5.2 that allows remote attackers to inject arbitrary HTML or JavaScript via cross-site scripting (XSS) vulnerabilities.
How does CVE-2017-16856 affect Atlassian Confluence?
CVE-2017-16856 affects Atlassian Confluence before version 6.5.2.
What is the severity of CVE-2017-16856?
CVE-2017-16856 has a severity keyword of 'medium' and a severity value of 6.1.
How can remote attackers exploit CVE-2017-16856?
Remote attackers can exploit CVE-2017-16856 by injecting arbitrary HTML or JavaScript via cross-site scripting (XSS) vulnerabilities in various RSS properties.
Are there any references available for CVE-2017-16856?
Yes, you can find more information about CVE-2017-16856 at the following sources: [1] http://www.securityfocus.com/bid/102094, [2] https://jira.atlassian.com/browse/CONFSERVER-54395