Medium · 5.4 CVE-2020-29444 EUVD-2020-21817GHSA-xvv9-f9hm-rghr

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Si…

Published May 7, 2021 · Updated Feb 12, 2025 · Assigned by atlassian

Vendor: Atlassian Product: Confluence Server Category: Web / CMS

Description

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters.

Affected products

Vendor	Product	Affected	Fixed
Atlassian	Confluence Server	unspecified – < 7.11.0	7.11.0

References

https://jira.atlassian.com/browse/CONFSERVER-61266