Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-59428

Confluence on Windows was vulnerable to DLL hijacking - CVE-2019-20406

XMLWordPrintable

      The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a dll file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.

      Acknowledgment

      We would like to thank Peleg Hadar of SafeBreach Labs for reporting this vulnerability.

            [CONFSERVER-59428] Confluence on Windows was vulnerable to DLL hijacking - CVE-2019-20406

            Adilson Carvalho (Inactive) made changes -
            Remote Link New: This issue links to "Page (Extranet)" [ 513678 ]
            Richard Atkins made changes -
            Fix Version/s Original: 6.13.12 [ 91816 ]
            Richard Atkins made changes -
            Fix Version/s New: 6.13.12 [ 91816 ]

            David Sumlin added a comment - - edited

            Why isn't the Long Term Support version 6.13.x being updated to address this vulnerability? I thought that was the whole promise of the Long Term Support concept?

            David Sumlin added a comment - - edited Why isn't the Long Term Support version 6.13.x being updated to address this vulnerability? I thought that was the whole promise of the Long Term Support concept?
            Adilson Carvalho (Inactive) made changes -
            Remote Link New: This issue links to "Page (Extranet)" [ 481374 ]
            Bruno Costa (Inactive) made changes -
            Description Original: The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a dll file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.
            		New: The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a dll file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.

            h3. Acknowledgment

            We would like to thank Peleg Hadar of SafeBreach Labs for reporting this vulnerability.
            Bruno Costa (Inactive) made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 471602 ]
            David Black made changes -
            Labels Original: advisory advisory-to-release cvss-medium dll-hijacking security New: advisory advisory-released cvss-medium dll-hijacking security
            David Black made changes -
            Security Original: Reporter and Atlassian Staff [ 10751 ]
            David Black made changes -
            Security New: Reporter and Atlassian Staff [ 10751 ]

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: