CVE-2020-36290 Cross-site scripting in Confluence Data Center

What is CVE-2020-36290?

CVE-2020-36290 is a medium-severity cross-site scripting vulnerability in Atlassian Confluence Data Center, published on 26 Jul 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.

Weakness: CWE-79

Which versions are affected by CVE-2020-36290?

It affects 2 products.

Products include Atlassian Confluence Data Center, Atlassian Confluence Server.

How do I fix CVE-2020-36290?

No fix has been published for CVE-2020-36290 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-36290 being exploited?

There is no known exploitation of CVE-2020-36290 in the wild and no public exploit code.

Other vulnerabilities in Atlassian Confluence Data Center

• CVE-2023-22527 Atlassian Confluence Data Center and Server Template Injection Exploited Critical 10.0
• CVE-2023-22518 Atlassian Confluence Data Center and Server Improper Authorization Exploited Critical 10.0
• CVE-2023-22515 Atlassian Confluence Data Center and Server Broken Access Control Exploited Critical 10.0
• CVE-2022-26134 Atlassian Confluence Server and Data Center Remote Code Execution Exploited Critical 9.8
• CVE-2021-26084 Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Exploited Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9r83-5mrw-rhhq.