Is there any description or symptomatology of this vulnerability?
It would be beneficial to know what to look for and where to look.
Replacing a jar doesn't provide much validation.

This issue does impact all 5.6 versions up to and including 5.6.5

Same question – does this affect 5.6.3 and 5.6.4 or are they ok?

I am unsure if this affects version 5.6.3. It says 5.6 and 5.6.5 fix version 5.6.6.

Should I assume this affects all version between 5.6 and 5.6.5?

It's still unclear to me. Does the attacker have to be logged in or is it enough that he has the details (knowledge) of an account? What is the "Confluence web interface"? Is the login page part of the web interface?

Yes, it now is. The wording was changed afterwards. See the Page History / the Activity of the issue for more details.

From the Advisory:

The attacker needs to have an account and be able to access the Confluence web interface.

I think this is pretty clear.

braxton1 there is no CVE for this vulnerability.

Is there a CVE for this vulnerability?

+1 "Does the attacker have to have a valid account, or can this be exploited by anonymous users"

It's irresponsible of Atlassian not to make this clear.

The last time this happened: "The attacker needs to be able to access the Confluence web interface. A valid user account is not required to exploit this vulnerability." OGNL double evaluation in atlassian-xwork
https://jira.atlassian.com/browse/CONF-30221

+1 "Does the attacker have to have a valid account, or can this be exploited by anonymous users"

+1 "Does the attacker have to have a valid account, or can this be exploited by anonymous users"

+1 "Does the attacker have to have a valid account, or can this be exploited by anonymous users"

+1 "Does the attacker have to have a valid account, or can this be exploited by anonymous users"

Does the attacker have to have a valid account, or can this be exploited by anonymous users.

@Patrick, well right. I suppose I could have phrased that more clearly. The question being: does this bug make the server vulnerable to attackers when they are not (or cannot) login.

Yes, by your registered users.
Edit: it says access to the UI, indeed not sure if non registered users can take advantage as well.

I'm guessing based on the Risk Mitigation description of this page: https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+-+2015-01-21 that an attacker does not need a login, but I'd like confirmation. So, in the case of a server which is publicly accessible, but does not allow anonymous access, is the server still vulnerable to this attack?