CVE-2020-36290
En bref Sévérité Non disponible EPSS EPSS 0.70 % · centile 53 (2026-10-27) État PUBLISHED Publiée 2022-07-26 Mise à jour 2024-10-03 Attribuée par atlassian Statut NVD Modified Description The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Configurations affectées (CPE NVD) cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* < 7.4.5cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.5.0 < 7.6.3cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.7.0 < 7.7.4cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* < 7.4.5cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.5.0 < 7.6.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.7.0 < 7.7.4Produits affectés Produit Versions Atlassian · Confluence Server affected unspecified < 7.4.5 ; affected 7.5.0 < unspecified ; affected unspecified < 7.6.3 ; affected 7.7.0 < unspecified ; affected unspecified < 7.7.4 Atlassian · Confluence Data Center affected unspecified < 7.4.5 ; affected 7.5.0 < unspecified ; affected unspecified < 7.6.3 ; affected 7.7.0 < unspecified ; affected unspecified < 7.7.4
Références
Sources
