Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Current »

From 2020-11-25 to 2020-12-03

We have released multiple versions between 2020-11-25 and 2020-12-03 of External Share for Cloud and Server (latest 2.4.0).

They contain numerous security patches:

External Share for Confluence (Server)

  • XSS via attachment name on external page

  • XSS in view links form via user full name

  • XSS via attached SVG

  • XSS via attached HTML

  • Reflected XSS via redirect param on password page

  • Invalidated Redirect on password page

  • XSS via space name in global share list

  • SQL Injection - GET /share (sort / sort order)

  • BAC | Attachment (media-proxy) - access to already generated media was not revoked after share settings changed

External Share for Confluence (Cloud)

  • XSS via attachment name on external page

  • XSS in view links form via user full name

  • Reflected XSS via redirect param on password page

  • Invalidated Redirect on password page

  • XSS via space name in global share list

  • SQL Injection - GET /share (sort / sort order)

  • BAC | Attachment (media-proxy) - access to already generated media was not revoked after share settings changed

  • No labels