Is CVE-2016-6283 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-6283 being exploited in the wild.

How severe is CVE-2016-6283?

Medium severity, with a CVSS score of 6.1, published 18 January 2017.

Which products and versions are affected?

Atlassian Confluence before 5.10.6.

Is there a fix for CVE-2016-6283?

A patch was published on 2016-08-04: Vendor released version 5.10.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-6283 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-6283?

Check whether you run Atlassian Confluence. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-6283: Atlassian Confluence persistent XSS in attachment properties

CVE-2016-6283 · Severity: medium · CVSS 6.1 · Published 2017-01-18

Atlassian Confluence, a popular team collaboration and documentation platform, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the system. By renaming a file attachment with a specially crafted name, an attacker can cause these scripts to execute in the browsers of other users who search for or view that file. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Vendors: Atlassian.

Quick answers

Is CVE-2016-6283 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-6283 being exploited in the wild.
How severe is CVE-2016-6283?: Medium severity, with a CVSS score of 6.1, published 18 January 2017.
Which products and versions are affected?: Atlassian Confluence before 5.10.6.
Is there a fix for CVE-2016-6283?: A patch was published on 2016-08-04: Vendor released version 5.10.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-6283 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-6283?: Check whether you run Atlassian Confluence. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A persistent cross-site scripting (XSS) vulnerability exists in Atlassian Confluence before version 5.10.6. The flaw is located in the 'doeditattachment.action' component, specifically within the 'newFileName' parameter. While initial file uploads may be sanitized, the application fails to properly validate or sanitize input when a user subsequently edits the properties of an existing attachment. An attacker can inject HTML or JavaScript into the filename; this payload is then executed when another user performs a search that returns the malicious attachment in the results. This vulnerability can be exploited by any user with permissions to edit attachment properties and affects all users who interact with the malicious search result. The issue was addressed in Confluence version 5.10.6.

Affected products

Atlassian Confluence before 5.10.6

Timeline

2016-07-07: disclosed: Vendor acknowledged the vulnerability
2016-08-04: patched: Vendor released version 5.10.6
2017-01-18: advisory: NVD published CVE-2016-6283

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.