Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-20508

Secure Administrator Sessions feature can be bypassed

XMLWordPrintable

      In some circumstances an attacker may be able to craft a request to a Confluence server that bypasses the additional layer of security added by the new Secure Administrator Sessions feature introduced in Confluence 3.3.

      This would allow an attacker to perform administrative functions on Confluence using a hijacked session without having to re-authenticate.

      This issue is rated HIGH. Please refer to http://confluence.atlassian.com/x/VgozDQ for information on other security related issue and more information on how we rate issues.

            [CONFSERVER-20508] Secure Administrator Sessions feature can be bypassed

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2880001 ] New: CONFSERVER Bug Workflow v4 [ 3003823 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2785684 ] New: JAC Bug Workflow v3 [ 2880001 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2715351 ] New: JAC Bug Workflow v2 [ 2785684 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2381436 ] New: JAC Bug Workflow [ 2715351 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2273544 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2381436 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2217156 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2273544 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2169921 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2217156 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1930302 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2169921 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v3 [ 1730704 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 1930302 ]
            Katherine Yabut made changes -
            Workflow Original: CONF Bug Subtask WF (TEMP) [ 1686781 ] New: Confluence Workflow - Public Facing - Restricted v3 [ 1730704 ]

              jclark@atlassian.com Joe Clark
              jclark@atlassian.com Joe Clark
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: