TI-2019-14511 Aliases CVE-2019-20102 GHSA-65gh-pwxv-875j

Cross-site scripting in Atlassian Confluence Server

LOW 29CWE-79Published 2020-04-22 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows remote attackers to achieve stored cross-site- scripting (SXSS) via a malicious attachment with a modified `mimeType` parameter.

Why it matters now

EPSS 0.01085 65th percentileScored 2026-11-07

Fix Fixed Confluence Server (Atlassian): 6.15.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Confluence Server	6.14.0 and later; up to 6.14.3; 6.15.0 and later; before 6.15.5	6.15.5	Patch available	CNA

Confluence Server VendorAtlassian Affected 6.14.0 and later; up to 6.14.3; 6.15.0 and later; before 6.15.5 Fixed in 6.15.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:confluence_server::::::::	6.14.0 – 6.14.3; 6.15.0 to before 6.15.5	Vulnerable	Atlassian

cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions 6.14.0 – 6.14.3; 6.15.0 to before 6.15.5 Vulnerable ·Atlassian

Remediation

Fix · CNA Confluence Server (Atlassian) Fixed in 6.15.5

Timeline

2026-10-02 Threatist record created from CVE-2019-20102
2026-10-03 Alias added: GHSA-65gh-pwxv-875j

References

Other 1

https://jira.atlassian.com/browse/CONFSERVER-59358

TI-2023-08765 Injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2023-08757 Improper input validation in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2022-09596 Expression language injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2021-08036 Expression language injection in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
TI-2019-02554 Path traversal in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
TI-2023-08759 Incorrect authorization in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences