Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-6283

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

6.1MEDIUM

EPSS

3.0%

top 13.47%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Atlassian Confluence

Timeline

PublishedJan 18

Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileName parameter to pages/doeditattachment.action.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDatlassian/confluence5.10.5

🔴Vulnerability Details

GHSA

GHSA-g266-84x9-9m56: Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5↗2022-05-17

▶

CVEList

CVE-2016-6283: Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5↗2017-01-18

▶

💥Exploits & PoCs

Exploit-DB

Atlassian Confluence < 5.10.6 - Persistent Cross-Site Scripting↗2017-01-04

▶