Need help resolving the vulnerabilities

[Anand Sudabattula]

Hi, 

We are in middle of production setup and held up with security scans in the test environment. 

We are using Confluence 5.10.6 Commercial edition. During the dynamic scans, the Qualys tool found the following vulnerabilities.

1) 150001 Reflected Cross-Site Scripting (XSS) Vulnerabilities

a) XSS vulnerabilities occur when the Web application echoes user-supplied data in an HTML response sent to the Web browser.......

Detection Information

Parameter	It has been detected by exploiting the parameter jql The payloads section will display a list of tests that show how the param could have been exploited to collect the information
Authentication	In order to detect this vulnerability, no authentication has been required.
Access Path	Here is the path followed by the scanner to reach the exploitable URL:

comment: A significant portion of the XSS test payload appeared in the web page, but the response content type is non-HTML.
Response content-type: application/json

Access path:    https://xx.xx.com/plugins/servlet/Wallboard/?dashboardId=10000

2) 150022 Syntax Error Occurred

 https://xx.xx.com/plugins/servlet/gadgets/dashboard-diagnostics

Detection Information

Request	AJAX request was used to detect this finding: https://xx.gm.com/plugins/servlet/gadgets/dashboard-diagnostics
Parameter	It has been detected by exploiting the parameter uri The payloads section will display a list of tests that show how the param could have been exploited to collect the information
Authentication	In order to detect this vulnerability, no authentication has been required.
Access Path	Here is the path followed by the scanner to reach the exploitable URL:
https://xxx.gm.com/ https://xx.gm.com/secure/Dashboard.jspa

The reflected string on the response webpage indicates that the vulnerability test was successful

[Volodymyr Krupach]

Hi Anand,

I remember passing these vulnerabilities scans for the internal network and for a custom web-application to comply with some security standard.

For vulnerabilities concerning 3-rd party webapplication like JIRA for you, we closed the holes by adding rules to proxy apache server. Please be aware that by doing this you can break JIRA functionality that relies on URL you closed.

[Nic Brough -Adaptavist-]

These reports are totally unclear on what the attack vectors are.  What form would an attack on the server take using them?