Confluence Docs 3.0 : Confluence 2.7.3 Release Notes This page last changed on Mar 19, 2008 by smaddox. 19 March 2008 Confluence 2.7.3 is a recommended upgrade which focuses on fixing a number of security flaws. Please refer to the security advisory for details of the vulnerabilities, risk assessment and mitigation strategies. There's a complete list of fixes below. Click a specific issue to see details of the fix, and to download patches where relevant. Don't have Confluence 2.7 yet? Take a look at the new features and other highlights in the Confluence 2.7 Release Notes. ## Upgrading from a Previous Version of Confluence Upgrading Confluence should be fairly straightforward. Please read the Confluence 2.7.3 Upgrade Guide. We strongly recommend that you back up your `confluence.home` directory and database before upgrading. ## Updates and Fixes in this Release
JIRA Issues (13 issues)
Type | Key | Summary | Priority | Status | Resolution
--- | --- | --- | --- | --- | ---
| CONF-11316 | Removing user throws NullPointerException |  | Closed | Fixed
| CONF-11153 | XSS vulnerability in social bookmarking plugin bundled in Confluence |  | Resolved | Fixed
| CONF-11149 | XSS vulnerability in browseusers.vm |  | Resolved | Fixed
| CONF-11141 | XSS vulnerabilities in insert image and link actions |  | Resolved | Fixed
| CONF-11081 | URL not encoded for group browser |  | Resolved | Fixed
| CONF-11042 | XSS vulnerabilities in create space action |  | Resolved | Fixed
| CONF-11040 | Grouppicker and Userpicker display unescaped user-entered content |  | Resolved | Fixed
| CONF-11027 | XSS vulnerabilities in create/edit/copy page and blogpost actions |  | Resolved | Fixed
| CONF-11026 | username not validated in add user to favourites action |  | Resolved | Fixed
| CONF-11019 | Fix XSS vulnerabilities in the stacktraces and cause by's displayed on the 500 error page |  | Resolved | Fixed
| CONF-11005 | XSS vulnerability in signup actions |  | Resolved | Fixed
| CONF-11002 | viewuser.action has an XSS problem around username |  | Resolved | Fixed
| CONF-9559 | Cross-site scripting vulnerability in /dashboard.action |  | Resolved | Fixed
Attachments: DownloadButtonSmall.jpg (image/jpeg)

Document generated by Confluence on Nov 05, 2009 23:29