-
Public Security Vulnerability
-
Resolution: Fixed
-
High
-
7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.8.0, 8.7.1, 8.9.0
-
None
-
7.1
-
High
-
CVE-2024-21690
-
Bug Bounty
-
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
-
Security Misconfiguration
-
Confluence Data Center, Confluence Server
This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 4.3 of Confluence Data Center and Server.
This Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability, with a CVSS Score of 7.1, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser and force a end user to execute unwanted actions on a web application in which they're currently authenticated which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires user interaction.
Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
- Confluence Data Center and Server 7.19: Upgrade to a release greater than or equal to 7.19.26
- Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.14
- Confluence Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5
- Confluence Data Center and Server 9.0: Upgrade to a release greater than or equal to 9.0.1
See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives).
This vulnerability was reported via our Bug Bounty program.
[CONFSERVER-97720] Reflected XSS and CSRF (Cross-Site Request Forgery) in Confluence Data Center and Server
Atlassian support have confirmed 8.9.5 is fixed, unlike the initial publication of this issue.
We received confirmation from two addons (Appfire), one , they don't have ETA for 9,x compatibility, and the other they say a "couple of weeks".
We need a work around. We can't wait a "couple of weeks".
May be a 8.9.6 version...
updating to 9.x is not yet possible for us. most apps / plugins do not even start. can it be confirmed that an update to 9.x is mandatory for 8.9.x installations?
If 8.9.5 is not fixed a version 8.9.6 or version 8.10 would be very helpful as there are many addons that are currently not compatible with version 9.0.
I think without compatible addons updating to version 9.0 will make many Confluence DC instances not usable anymore.
Any reason why the CVE-2024-21690 is not published on https://nvd.nist.gov/vuln/detail/CVE-2024-21690 yet?
Is version 8.9.5 also supportet and fixed?
Maybe it is like CONFSERVER-97657 ?
Is this issue missing some affects versions, as only x.y.0 versions are listed? This means you can't search the version you have installed to see if it is effected.