medium6.8
CVE-2019-15053
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors…
Impact
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Atlassian | Html Include And Replace Macro | from 1.1 through 1.4.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/l0nax/CVE-2019-15053
- https://marketplace.atlassian.com/apps/4885/html-include-and-replace-macro?hosting=server&tab=versions
- https://github.com/l0nax/CVE-2019-15053
- https://marketplace.atlassian.com/apps/4885/html-include-and-replace-macro?hosting=server&tab=versions