CVE-2020-36290

5.4 mediumEPSS 0.7%

Medium (5.4) in atlassian. EPSS 0.7% chance of exploitation in the next 30 days.

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-07-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:confluence_data_center
atlassian:confluence_server

References

https://jira.atlassian.com/browse/CONFSERVER-60118
https://jira.atlassian.com/browse/CONFSERVER-60118

Check your stack JSON