Security Advisories

This page provides an overview for security vulnerabilities that have been identified and resolved.

Key	Summary	Status
EXP-3477	Broken Access Control in Comala Document Mgmt for Scroll Exporters	Released to Server
EXP-3404	User without space permissions can export with space-specific templates	Released
EXP-3403	Unauthorized user can download template data via public REST API	Released to Server
EXP-3374	XSS vulnerability in Scroll Exporter user interface	Released to Server
EXP-3252	Path traversal vulnerability in REST API	Released to Server
EXP-3211	Disclosure of installed Scroll Exporter app details	Released to Server
EXP-3170	Disclosure of custom template placeholders	Released to Server
EXP-3169	SSRF vulnerability in Scroll Exporter apps	Released to Server
EXP-3168	Insufficient permission checks in export template REST API	Released to Server
EXP-3167	Potential Denial of Service due to lack of authentication in REST API	Released to Server
EXP-2834	DOM-XSS vulnerability in Scroll PDF Exporter and Scroll Word Exporter 2019-09-16	Released to Cloud
EXP-2826	Access token leak in Scroll Exporter apps for Confluence Cloud 2019-09-06	Released to Cloud
EXP-2825	SSRF vulnerability in Scroll Word Exporter 2019-09-05	Released
EXP-2802	XSS vulnerability in template upload mechanism 2019-07-04	Released
EXP-2779	Remote code execution vulnerability in Scroll Exporter apps 2019-06-17	Released
EXP-2614	The bundled Scroll Runtime plugin does not check permissions under certain conditions (2018-12-17)	Released to Server

16 issues