CVE-2019-15053

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.

Score

CVSS 3.0 6.8 Medium

Status

Modified - cve@mitre.org

Published

2019-08-14

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Html Include And Replace Macro (Atlassian)

References

• https://github.com/l0nax/CVE-2019-15053
• https://marketplace.atlassian.com/apps/4885/html-include-and-replace-macro?hosting=server&tab=versions