Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-67893

Pre-Authorization Arbitrary File Read in /s/ endpoint - CVE-2021-26085

XMLWordPrintable

    • 5.2
    • Medium
    • CVE-2021-26085

      Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint.

      The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

      This vulnerability was discovered by Amit Laish, GE Digital, Cyber Security Lab.

       

      Affected versions:

      • version < 7.4.10
      • 7.5.0 ≤ version < 7.12.3

      Fixed versions:

      • 7.4.10
      • 7.12.3
      • 7.13.0
      • 7.14.0  

          Form Name

            [CONFSERVER-67893] Pre-Authorization Arbitrary File Read in /s/ endpoint - CVE-2021-26085

            Mandeep Jadon made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 733516 ]
            Cathy S made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 647677 ]
            Cathy S made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 628992 ]

            Aleksandr Kuznetsov added a comment - - edited

            Will the fix be prepared for Data Center v7.11.6 ?

            Aleksandr Kuznetsov added a comment - - edited Will the fix be prepared for Data Center v7.11.6 ?
            Thiago Masutti made changes -
            Link New: This issue is related to JRASERVER-72695 [ JRASERVER-72695 ]
            Thiago Masutti made changes -
            Link New: This issue is related to CONFSERVER-60469 [ CONFSERVER-60469 ]
            Thiago Masutti made changes -
            Link New: This issue is related to CONFSERVER-60313 [ CONFSERVER-60313 ]

            Alfredo Hickman added a comment -

            When's the fix for Atlassian cloud supposed to go live? We use Altassian cloud at my company and I've verified that I can read certain files without authentication in my account.

            Alfredo Hickman added a comment - When's the fix for Atlassian cloud supposed to go live? We use Altassian cloud at my company and I've verified that I can read certain files without authentication in my account.
            Security Metrics Bot made changes -
            CVE ID New: CVE-2021-26085
            Rachel Robins made changes -
            Fix Version/s Original: 7.14.0 [ 94828 ]

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

                Created:
                Updated:
                Resolved: