Design/Logic Flaw

2019-08-1417:15:00

PRIOn knowledge base

www.prio-n.com

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.0%

JSON

The “HTML Include and replace macro” plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.

CPENameOperatorVersion
html_include_and_replace_macroge1.1
html_include_and_replace_macrole1.4.2

CPE	Name	Operator	Version
	html_include_and_replace_macro	ge	1.1
	html_include_and_replace_macro	le	1.4.2

References

github.com/l0nax/CVE-2019-15053

marketplace.atlassian.com/apps/4885/html-include-and-replace-macro?hosting=server&tab=versions