Confluence Docs 3.0 : Confluence Security Advisory 2006-01-20 This page last changed on Jan 20, 2006 by jeremy@atlassian.com. A flaw has been found in Confluence by which attackers to inject malicious HTML code into Confluence. Atlassian STRONGLY recommends that all Confluence customers apply the fix described below immediately, or upgrade to Confluence 2.1.3. ### Vulnerability By entering HTML/JavaScript code into the full name of a user's profile, attackers can cause arbitrary scripting code to be executed by the user's browser in the security context of the Confluence instance. This flaw affects all versions of Confluence between 1.4-DR releases and 2.1.2. This issue was initally reported by Ricardo Sueiras and a fix was quickly documented by Dan Hardiker at the Confluence Community Security Advisory 2006-01-19 page. Our thanks to them for bringing this to our attention. There is an issue in JIRA at CONF-5233. ### Fix This vulnerability is fixed in Confluence 2.1.3 and later. Customers who do not wish to migrate to 2.1.3 can fix this bug using the procedure below: Steps to fix: Copy macros.vm to your confluence/template/includes folder Restart Confluence Note: If you are using version 1.4.4, please download and copy this file instead. You will need to rename it back to `macros.vm`. If you are not using any of the above versions, you will need to replace wrap calls to display full names of users in $generalUtil.htmlEncode(). Alternatively, send us an email. We do however encourage you to use the latest stable point release regardless of the version you are using. Attachments: macros.vm (application/octet-stream) macros_1_4_4.vm (application/octet-stream)

Document generated by Confluence on Nov 05, 2009 23:26