CVE-2020-36290

Published: Jul 26, 2022Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.

Affected (6)

Products: Atlassian: Confluence Data Center, Confluence Server

Atlassian

2 products

Confluence Data Center

Confluence Server

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Atlassian Confluence Data Center	Before 7.4.5
Atlassian Confluence Data Center	From 7.5.0 to 7.6.3
Atlassian Confluence Data Center	From 7.7.0 to 7.7.4
Atlassian Confluence Server	Before 7.4.5
Atlassian Confluence Server	From 7.5.0 to 7.6.3
Atlassian Confluence Server	From 7.7.0 to 7.7.4

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://jira.atlassian.com/browse/CONFSERVER-60118

Source: security@atlassian.com

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/CONFSERVER-60118

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.