Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-82436

Information disclosure via Synchrony service

XMLWordPrintable

    • 6.5
    • Medium

      Affected versions of Atlassian Confluence Server allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the Synchrony service.

      This vulnerability was discovered by Rojan Rijal of Tinder Security Engineering.

      The affected versions are before version 7.13.14, from version 7.14.0 before 7.19.6, and from version 7.20.0 before 8.1.0.

      Affected versions:

      • version < 7.13.14
      • 7.14.0 ≤ version < 7.19.6
      • 7.20.0 ≤ version < 8.1.0

      Fixed versions:

      • 7.13.14
      • 7.19.6
      • 8.1.0

            [CONFSERVER-82436] Information disclosure via Synchrony service

            Aline Souza added a comment -

            Hi Team,

            could you please confirm either Confluence Data Center is affected by it? 
            Thank you & Regards

            Aline 

            Aline Souza added a comment - Hi Team, could you please confirm either Confluence Data Center is affected by it?  Thank you & Regards Aline 

            Simon Peters (L) added a comment -

            What sort of Information Disclosure is this.

            Is it one of those things where you can only get confirmation if a thing with a certain name exists or is there a risk of Page Content, Attachment or Credential leak via this vulnerability?

            Simon Peters (L) added a comment - What sort of Information Disclosure is this. Is it one of those things where you can only get confirmation if a thing with a certain name exists or is there a risk of Page Content, Attachment or Credential leak via this vulnerability?

            Security Metrics Bot added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment.

            CVSS v3 score: 6.5 => Medium severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required None
            User Interaction None

            Scope Metric

            Scope Unchanged

            Impact Metrics

            Confidentiality Low
            Integrity Low
            Availability None

            https://asecurityteam.bitbucket.io/cvss_v3/?#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

            Security Metrics Bot added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 6.5 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality Low Integrity Low Availability None https://asecurityteam.bitbucket.io/cvss_v3/?#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: