Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-33515

ClassLoader Manipulation vulnerability

XMLWordPrintable

      We have fixed a vulnerability in our version of an Xwork library which is also part of Apache Struts. Attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. The attacker needs to be able to access the Confluence web interface. In cases when anonymous access is enabled, a valid user account is not required to exploit this vulnerability.

      We have discovered this vulnerability during our review of the recent Struts security advisories. This vulnerability is specific to Confluence.
      The vulnerability affects all versions of Confluence up to and including 5.5.1.

      For more information see the full advisory.

        1. atlassian-xwork-core-1.17.jar
          43 kB

            [CONFSERVER-33515] ClassLoader Manipulation vulnerability

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2893349 ] New: CONFSERVER Bug Workflow v4 [ 2984866 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2793266 ] New: JAC Bug Workflow v3 [ 2893349 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2723047 ] New: JAC Bug Workflow v2 [ 2793266 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2386138 ] New: JAC Bug Workflow [ 2723047 ]
            Alex Yakovlev (Inactive) made changes -
            Labels Original: advisory affects-server bugfix cvss-critical loyalty security New: advisory affects-server cvss-critical loyalty security
            Alex Yakovlev (Inactive) made changes -
            Labels Original: advisory affects-server bugfix cvss-critical security New: advisory affects-server bugfix cvss-critical loyalty security
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2283091 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2386138 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2223699 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2283091 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2176991 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2223699 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1941833 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2176991 ]

              Unassigned Unassigned
              vosipov VitalyA
              Affected customers:
              0 This affects my team
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: