Stored XSS Vulnerability in Confluence Data Center and Server by Atlassian

CVE-2024-21686

Summary

A stored cross-site scripting (XSS) vulnerability has been identified in Confluence Data Center and Server, affecting versions 7.13 and earlier. This vulnerability allows an authenticated attacker to inject and execute arbitrary HTML or JavaScript code in the context of a victim's browser. The exploitation of this vulnerability poses significant risks to the confidentiality and integrity of user data, necessitating immediate attention from affected users. Atlassian advises all customers running vulnerable versions to upgrade to the latest version. For users unable to upgrade, migrating to one of the specified fixed versions is strongly recommended. More details and release notes can be found in Atlassian's documentation.

References