{"api_version":"1","generated_at":"2026-07-24T18:39:48+00:00","cve":"CVE-2017-16856","urls":{"html":"https://cve.report/CVE-2017-16856","api":"https://cve.report/api/cve/CVE-2017-16856.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-16856","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-16856"},"summary":{"title":"CVE-2017-16856","description":"The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.","state":"PUBLISHED","assigner":"atlassian","published_at":"2017-12-05 16:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-79","Cross Site Scripting (XSS)"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/102094","name":"http://www.securityfocus.com/bid/102094","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Atlassian Confluence CVE-2017-16856 Multiple Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://jira.atlassian.com/browse/CONFSERVER-54395","name":"https://jira.atlassian.com/browse/CONFSERVER-54395","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"title":"[CONFSERVER-54395] XSS through various RSS properties in the RSS macro - CVE-2017-16856 - Create and track feature requests for Atlassian products.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16856","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16856","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Atlassian","product":"Confluence","version":"affected All versions prior to version 6.5.2","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"16856","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"confluence","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2017","cve_id":"16856","cve":"CVE-2017-16856","epss":"0.001870000","percentile":"0.402350000","score_date":"2026-05-15","updated_at":"2026-05-16 00:02:07"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T20:35:21.189Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://jira.atlassian.com/browse/CONFSERVER-54395"},{"name":"102094","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/102094"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Confluence","vendor":"Atlassian","versions":[{"status":"affected","version":"All versions prior to version 6.5.2"}]}],"datePublic":"2017-12-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme."}],"problemTypes":[{"descriptions":[{"description":"Cross Site Scripting (XSS)","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-12-08T10:57:01.000Z","orgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","shortName":"atlassian"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://jira.atlassian.com/browse/CONFSERVER-54395"},{"name":"102094","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/102094"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2017-12-05T00:00:00","ID":"CVE-2017-16856","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Confluence","version":{"version_data":[{"version_value":"All versions prior to version 6.5.2"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross Site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://jira.atlassian.com/browse/CONFSERVER-54395","refsource":"CONFIRM","url":"https://jira.atlassian.com/browse/CONFSERVER-54395"},{"name":"102094","refsource":"BID","url":"http://www.securityfocus.com/bid/102094"}]}}}},"cveMetadata":{"assignerOrgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","assignerShortName":"atlassian","cveId":"CVE-2017-16856","datePublished":"2017-12-05T16:00:00.000Z","dateReserved":"2017-11-16T00:00:00.000Z","dateUpdated":"2024-09-16T23:10:55.644Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-12-05 16:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-79","Cross Site Scripting (XSS)"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*","versionEndExcluding":"6.5.2","matchCriteriaId":"D25A9B06-1960-4297-B1B9-E93D331EAF55"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"16856","Ordinal":"1","Title":"CVE-2017-16856","CVE":"CVE-2017-16856","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"16856","Ordinal":"1","NoteData":"The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.","Type":"Description","Title":"CVE-2017-16856"},{"CveYear":"2017","CveId":"16856","Ordinal":"2","NoteData":"2017-12-05","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"16856","Ordinal":"3","NoteData":"2017-12-08","Type":"Other","Title":"Modified"}]}}}