Unscored

CVE-2020-36290

Atlassian Confluence Server; Atlassian Confluence Data Center Published: 2022-07-26 07:05 (4 years ago)

Description

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Atlassian	Confluence Data Center	unspecified – < 7.4.5, 7.5.0 – < unspecified, unspecified – < 7.6.3, 7.7.0 – < unspecified, unspecified – < 7.7.4
Atlassian	Confluence Server	unspecified – < 7.4.5, 7.5.0 – < unspecified, unspecified – < 7.6.3, 7.7.0 – < unspecified, unspecified – < 7.7.4

References and patches

https://jira.atlassian.com/browse/CONFSERVER-60118

CVSS score

Not scored yet. It appears here once the CNA, CISA or NVD scores it.

EPSS (chance of exploitation in 30 days)

0.70%

higher than 54% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2021-03-31
Published2022-07-26 07:05
Reached IP-DB2026-10-25 00:05
Last updated2024-10-03 21:36

Assigned by (CNA): atlassian

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Atlassian Confluence / Jira

9.3Critical

CVE-2026-21589 KEV 1 month ago

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian Bamboo Data Center; Atlassian Bitbucket Data Center; Atlassian Confluence Data Center; Atlassian Crowd Data Center

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthent…

100%EPSS

7.1High

CVE-2026-21586 2 months ago

Atlassian Confluence Data Center

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with …

7.1High

CVE-2026-21587 2 months ago

Atlassian Jira Service Management Data Center

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended acces…

7.1High

CVE-2026-21588 2 months ago

Atlassian Confluence Data Center

This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1,…

8.6High

CVE-2026-21580 2 months ago

Atlassian Confluence Data Center; Atlassian Confluence Server

This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 1…

7.1High

CVE-2026-21577 3 months ago

Atlassian Confluence Data Center

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows …