Need help resolving the vulnerabilities

Question

Hi,

We are in middle of production setup and held up with security scans in the test environment.

We are using Confluence 5.10.6 Commercial edition. During the dynamic scans, the Qualys tool found the following vulnerabilities.

1) 150001 Reflected Cross-Site Scripting (XSS) Vulnerabilities

a) XSS vulnerabilities occur when the Web application echoes user-supplied data in an HTML response sent to the Web browser.......

Detection InformationParameterIt has been detected by exploiting the parameter jql
The payloads section will display a list of tests that show how the param could have been exploited to collect the informationAuthenticationIn order to detect this vulnerability, no authentication has been required.Access PathHere is the path followed by the scanner to reach the exploitable URL:

comment: A significant portion of the XSS test payload appeared in the web page, but the response content type is non-HTML.
Response content-type: application/json

Access path:    https://xx.xx.com/plugins/servlet/Wallboard/?dashboardId=10000

2) 150022 Syntax Error Occurred

https://xx.xx.com/plugins/servlet/gadgets/dashboard-diagnostics

Detection InformationRequestAJAX request was used to detect this finding: https://xx.gm.com/plugins/servlet/gadgets/dashboard-diagnosticsParameterIt has been detected by exploiting the parameter uri
The payloads section will display a list of tests that show how the param could have been exploited to collect the informationAuthenticationIn order to detect this vulnerability, no authentication has been required.Access PathHere is the path followed by the scanner to reach the exploitable URL:https://xxx.gm.com/
https://xx.gm.com/secure/Dashboard.jspa

The reflected string on the response webpage indicates that the vulnerability test was successful

Volodymyr Krupach @BrizoIT · Answer

Hi Anand,

I remember passing these vulnerabilities scans for the internal network and for a custom web-application to comply with some security standard.

For vulnerabilities concerning 3-rd party webapplication like JIRA for you, we closed the holes by adding rules to proxy apache server. Please be aware that by doing this you can break JIRA functionality that relies on URL you closed.

Nic Brough -Adaptavist- · Answer

These reports are totally unclear on what the attack vectors are.  What form would an attack on the server take using them?