How to fix the vulnerability CVE-2020-29444

[Shraddha Sudheendra]

I need to fix the vulnerability, CVE-2020-29444 in Confluence server and Data center. I am not able to find any articles related to this. I need to know the information on the affected versions, fixed version etc.

[Fabio Racobaldo _Herzum_ · Accepted solution]

Hi @Shraddha Sudheendra ,

welcome to the Atlassian community!

As specified here https://jira.atlassian.com/browse/CONFSERVER-61266 :

Affected versions of Team Calendar in Confluence Server allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting vulnerability in admin global setting parameters.

Affected versions:

• < 7.11.0

Fixed version:

• 7.11.0

Hope this helps,

Fabio

[Andy Heinzer]

I recommend upgrading to a 7.13.x version as it will contain the fix for https://jira.atlassian.com/browse/CONFSERVER-61266

But more specifically, upgrade to 7.13.7 as this also contains the fix for the more recent Advisory.  Plus this version is part of our Long term support releases, which ensures this minor version will continue to receive critical fixes throughout its supported term.

[Shraddha Sudheendra]

Sure, Thank you..

[Alex Koxaras -Relational-]

Hi @Shraddha Sudheendra and welcome to the community!

From what I read you had to upgrade the version of Confluence. According to this https://jira.atlassian.com/browse/CONFSERVER-61266?jql=labels%20%3D%20CVE-2020-29444 your version is most likely affected.

You could also try to upgrade the Team Calendar as it is stated here https://confluence.atlassian.com/teamcal/team-calendars-7-0-16-release-notes-1050549224.html

[Shraddha Sudheendra]

Thanks Alex

[Steven Schouppe]

Hi @Shraddha Sudheendra ,

Welcome!

As suggested here already, you should be OK if you're on the most recent LTS (= 7.13.7 today) and update Teams Calendar along with it.

LTS 7.13.7 will also introduce a fix for CVE-2022-26134.

Cheers,
Steven