Affected versions of Atlassian Confluence Data Center in Windows installations contain a security misconfiguration in which the confluence.cfg.xml file is readable by users in the BUILTIN/Users group by default.

An attacker with local access to the Windows host with Confluence Data Center installed within the BUILTIN/Users group can read sensitive information within the confluence.cfg.xml configuration file which could lead to local privilege escalation as the Confluence installation user. The CWE ID for this vulnerability is CWE-732: Incorrect Permission Assignment for Critical Resource.

Affected Versions:

• version < 8.7.1

Fixed Versions:

• 7.19.18
• 8.5.5
• 8.7.2
• 8.8.0