CVE-2020-36290
Severity Score
5.4
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.
Livesearch macro in Confluence Server and Data Center versiones anteriores a 7.4.5, desde versión 7.5.0 anteriores a 7.6.3, y desde versión 7.7.0 anteriores a 7.7.4, permite a atacantes remotos con permiso para editar una página o blog inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) en la funcionalidad page excerpt.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-03-31 CVE Reserved
- 2022-07-26 CVE Published
- 2024-02-16 EPSS Updated
- 2024-10-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://jira.atlassian.com/browse/CONFSERVER-60118 | 2022-08-01 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Atlassian Search vendor "Atlassian" | Confluence Data Center Search vendor "Atlassian" for product "Confluence Data Center" | < 7.4.5 Search vendor "Atlassian" for product "Confluence Data Center" and version " < 7.4.5" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Confluence Data Center Search vendor "Atlassian" for product "Confluence Data Center" | >= 7.5.0 < 7.6.3 Search vendor "Atlassian" for product "Confluence Data Center" and version " >= 7.5.0 < 7.6.3" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Confluence Data Center Search vendor "Atlassian" for product "Confluence Data Center" | >= 7.7.0 < 7.7.4 Search vendor "Atlassian" for product "Confluence Data Center" and version " >= 7.7.0 < 7.7.4" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Confluence Server Search vendor "Atlassian" for product "Confluence Server" | < 7.4.5 Search vendor "Atlassian" for product "Confluence Server" and version " < 7.4.5" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Confluence Server Search vendor "Atlassian" for product "Confluence Server" | >= 7.5.0 < 7.6.3 Search vendor "Atlassian" for product "Confluence Server" and version " >= 7.5.0 < 7.6.3" | - |
Affected
| ||||||
| Atlassian Search vendor "Atlassian" | Confluence Server Search vendor "Atlassian" for product "Confluence Server" | >= 7.7.0 < 7.7.4 Search vendor "Atlassian" for product "Confluence Server" and version " >= 7.7.0 < 7.7.4" | - |
Affected
| ||||||