ClassLoader Manipulation vulnerability

We have fixed a vulnerability in our version of an Xwork library which is also part of Apache Struts. Attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. The attacker needs to be able to access the Confluence web interface. In cases when anonymous access is enabled, a valid user account is not required to exploit this vulnerability.

We have discovered this vulnerability during our review of the recent Struts security advisories. This vulnerability is specific to Confluence.
The vulnerability affects all versions of Confluence up to and including 5.5.1.

For more information see the full advisory.