Test ID:	1.3.6.1.4.1.25623.1.0.106492
Category:	Web application abuses
Title:	Atlassian Confluence XSS Vulnerability
Summary:	Atlassian Confluence is prone to a cross-site scripting vulnerability.
Description:	Summary: Atlassian Confluence is prone to a cross-site scripting vulnerability. Vulnerability Insight: Atlassian Confluence is vulnerable to a persistent cross-site scripting vulnerability because it fails to securely validate user controlled data. The bug occurs at pages carrying attached files, even though the attached file name parameter is correctly sanitized upon submission, it is possible for an attacker to later edit the attached file name property and supply crafted data (i.e HTML tags and script code) without the occurrence of any security checks, resulting in an exploitable persistent XSS. Affected Software/OS: Atlassian Confluence before version 5.10.6. Solution: Update to 5.10.6 or later versions. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6283 BugTraq ID: 95288 http://www.securityfocus.com/bid/95288 https://www.exploit-db.com/exploits/40989/ http://seclists.org/fulldisclosure/2017/Jan/3 http://seclists.org/fulldisclosure/2017/Jan/12 http://packetstormsecurity.com/files/140363/Atlassian-Confluence-5.9.12-Cross-Site-Scripting.html Common Vulnerability Exposure (CVE) ID: CVE-2016-4317 BugTraq ID: 97513 http://www.securityfocus.com/bid/97513 https://jira.atlassian.com/browse/CONF-42713 https://jira.atlassian.com/browse/CONFSERVER-42713
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.