This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.0 of Confluence Data Center and Server. This Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability, with a CVSS Score of 7.1, allows an unauthenticated attacker to execute arbitrary HTML…
Severity
High 8.2
Published
21 Aug 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD
Affected software
Software
Affected versions
ConfluenceServers and applications · cpe:a:atlassian:confluence_data_center
From 8.9.0 up to 8.9.4
From 8.8.0 up to 8.8.1
From 8.7.1 up to 8.7.2
From 8.6.0 up to 8.6.2
All 12 release lines
From 7.19.0 up to 7.19.25
From 7.20.0 up to 7.20.3
From 8.0.0 up to 8.0.4
From 8.1.0 up to 8.1.4
From 8.2.0 up to 8.2.3
From 8.3.0 up to 8.3.4
From 8.4.0 up to 8.4.5
From 8.5.0 up to 8.5.12
From 8.6.0 up to 8.6.2
From 8.7.1 up to 8.7.2
From 8.8.0 up to 8.8.1
From 8.9.0 up to 8.9.4
ConfluenceServers and applications · cpe:a:atlassian:confluence_server