CVE-2017-16856 Cross-site scripting in Confluence

What is CVE-2017-16856?

CVE-2017-16856 is a medium-severity cross-site scripting vulnerability in Atlassian Confluence, published on 5 Dec 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.

Weakness: CWE-79

Which versions are affected by CVE-2017-16856?

It affects 1 product.

Products include Atlassian Confluence.

How do I fix CVE-2017-16856?

No fix has been published for CVE-2017-16856 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-16856 being exploited?

There is no known exploitation of CVE-2017-16856 in the wild and no public exploit code.

Other vulnerabilities in Atlassian Confluence

• CVE-2019-3395 Server-side request forgery in Confluence Server Critical 9.8
• CVE-2019-3394 Path traversal in Confluence Server High 8.8
• CVE-2019-20406 Privilege escalation in Confluence Data Center High 7.8
• CVE-2019-15006 Other in Confluence Server Medium 6.5
• CVE-2017-18085 Cross-site scripting in Confluence Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7x5g-hwfp-5cwv.