CVE-2015-8398: Atlassian Confluence

Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to rest/prototype/1/session/check.

Affected products

• Atlassian Confluence: up to and including 5.8.16

Published 2016-04-11. Last modified 2026-06-17.