Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-30887

doremovespacemail action can be called by non-admins

XMLWordPrintable

      The doremovespacemail action is provided by the confluence-mail-archiving plugin, and allows all of the archived mail associated with a space to be removed. This action can be called by any authenticated user, which appears to be an oversight in access control, given that similar methods (such as doremovemail) firstly check that the caller has REMOVE_MAIL_PERMISSION permission.

      This could allow a malicious Confluence user who only has view access to a particular space to remove all of the archived mail from that space.

            [CONFSERVER-30887] doremovespacemail action can be called by non-admins

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2879971 ] New: CONFSERVER Bug Workflow v4 [ 2988691 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2780057 ] New: JAC Bug Workflow v3 [ 2879971 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2723083 ] New: JAC Bug Workflow v2 [ 2780057 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2393749 ] New: JAC Bug Workflow [ 2723083 ]
            Alex Yakovlev (Inactive) made changes -
            Labels Original: NCC affects-server bugfix cvss-medium loyalty mail-archiving mail_archive security New: NCC affects-server cvss-medium loyalty mail-archiving mail_archive security
            Alex Yakovlev (Inactive) made changes -
            Labels Original: NCC affects-server bugfix cvss-medium mail-archiving mail_archive security New: NCC affects-server bugfix cvss-medium loyalty mail-archiving mail_archive security
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2288612 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2393749 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2227348 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2288612 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2182824 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2227348 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1951039 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2182824 ]

              psemeniuk Petro Semeniuk (Inactive)
              4d658525b00b Richard Turnbull
              Affected customers:
              0 This affects my team
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: