Detections
Analytics

Atlassian Confluence Server 5.8.x < 5.8.6 Multiple Vulnerabilities

medium Nessus Network Monitor Plugin ID 9645

Synopsis

The remote Confluence server is affected by multiple vulnerabilities.

Description

Versions of Confluence 5.8.x prior to 5.8.6 are affected by multiple vulnerabilities :

 - A flaw exists that is triggered during the handling of disabled user accounts. This may allow a user with a disabled account still to receive unintended notifications that contain sensitive information.
 - A flaw exists that allows a stored cross-site scripting (XSS) attack. This flaw exists because the comment module does not validate input when handling comments in embedded SWF files before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Solution

Upgrade to Confluence 5.8.x version 5.8.6 or later.

See Also

https://jira.atlassian.com/browse/CONF-38127

https://jira.atlassian.com/projects/CONF/versions/54995

Plugin Details

Severity: Medium

ID: 9645

Family: CGI

Published: 10/14/2016

Updated: 3/6/2019

Vulnerability Information

CPE: cpe:/a:atlassian:confluence

Patch Publication Date: 7/21/2015

Vulnerability Publication Date: 7/16/2015