Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-10289

Security vulnerability with Dashboard spacesSelectedTab

XMLWordPrintable

      Our security team has reported the following vulnerability, which must be resolved for us to use the application.

      > Severity: High
      > Test Type: Application
      > Vulnerable URL: https://gforgewiki.nci.nih.gov/dashboard.action
      > (Parameter =
      > spacesSelectedTab)
      > Remediation Tasks: Filter out hazardous characters from user input

        1. Appscan_highalert.rtf
          6 kB
        2. RecentlyUpdatedContentMacro.class
          18 kB
        3. RecentlyUpdatedContentMacro.class
          18 kB
        4. RecentlyUpdatedContentMacro-2.6.diff
          1 kB

          Form Name

            [CONFSERVER-10289] Security vulnerability with Dashboard spacesSelectedTab

            dave (Inactive) added a comment -

            This issue only affects Confluence version 2.6 and 2.7. Customers using earlier versions need not worry about this vulnerability.

            dave (Inactive) added a comment - This issue only affects Confluence version 2.6 and 2.7. Customers using earlier versions need not worry about this vulnerability.

            Paul Curren added a comment -

            The attached class files can be used to patch a 2.6.2 Confluence instance or a 2.7 install. When 2.7.1 is released it will include the fix.

            The patch for Confluence 2.6.2 is the attachment called RecentlyUpdatedContentMacro.class which is dated 23rd December, 10:38pm. The md5 checksum is 62bbd048b7f8c3219edef3d976c55cf8
            The patch for Confluence 2.7 is the attachment called RecentlyUpdatedContentMacro.class which is dated 23rdrd December 10:28pm. The md5 checksum is 2249097a8bbd21d67e5fe2ff9ae91a9d

            In each case the install instructions are -

            1. Within your confluence installation, at confluence/WEB-INF/classes create the directory com/atlassian/confluence/renderer/radeox/macros.
            2. Copy the appropriate class file to this newly created directory.
            3. Restart Confluence.

            Paul Curren added a comment - The attached class files can be used to patch a 2.6.2 Confluence instance or a 2.7 install. When 2.7.1 is released it will include the fix. The patch for Confluence 2.6.2 is the attachment called RecentlyUpdatedContentMacro.class which is dated 23rd December, 10:38pm . The md5 checksum is 62bbd048b7f8c3219edef3d976c55cf8 The patch for Confluence 2.7 is the attachment called RecentlyUpdatedContentMacro.class which is dated 23rdrd December 10:28pm . The md5 checksum is 2249097a8bbd21d67e5fe2ff9ae91a9d In each case the install instructions are - Within your confluence installation, at confluence/WEB-INF/classes create the directory com/atlassian/confluence/renderer/radeox/macros . Copy the appropriate class file to this newly created directory. Restart Confluence.

            Paul Curren added a comment -

            Fix has been merged to 2.7.1 release.
            Patches for 2.6.2 and 2.7 will be created shortly.

            Paul Curren added a comment - Fix has been merged to 2.7.1 release. Patches for 2.6.2 and 2.7 will be created shortly.

              pcurren Paul Curren
              43bd830fd92b Mary Johnson
              Affected customers:
              0 This affects my team
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: