CVE-2019-20102: Atlassian Confluence Server

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows remote attackers to achieve stored cross-site- scripting (SXSS) via a malicious attachment with a modified `mimeType` parameter.

Affected products

• Atlassian Confluence Server: from 6.14.0, up to and including 6.14.3; from 6.15.0, before 6.15.5 (fixed in 6.15.5)

Published 2020-04-22. Last modified 2026-06-17.