CVE-2020-14175: 
Confluence Server vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was identified in Atlassian Confluence Server and Data Center, tracked as CVE-2020-14175. The vulnerability was discovered by Colin Xu and disclosed on July 24, 2020. The affected versions include all versions before 7.4.2 and versions from 7.5.0 to versions before 7.5.2 (Vendor Advisory).

The vulnerability allows remote attackers to inject arbitrary HTML or JavaScript through user macro parameters. The severity of this vulnerability is rated as MEDIUM with a CVSS v3.1 base score of 5.4 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Under CVSS v2.0, it received a LOW severity score of 3.5. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If exploited, this vulnerability could allow attackers to execute arbitrary HTML or JavaScript code in the context of other users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions typical of XSS attacks (NVD).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. The attack vector is network-accessible, with low attack complexity (NVD).

Atlassian has released fixed versions to address this vulnerability. Users should upgrade to version 7.4.2, 7.5.2, or 7.6.0 to mitigate the risk. These versions contain the necessary security patches to prevent the XSS attack vector (Vendor Advisory).