Confluence Security Advisory 2022-06-02

Topic

New Reply

Confluence Server and Data Center – CVE-2022-26134 – Critical severity unauthenticated remote code execution vulnerability

Confluence

Confluence Server
Confluence Data Center

All supported versions of Confluence Server and Data Center are affected.
Confluence Server and Data Center versions after 1.3.0 are affected.

Atlassian rates the severity level of this vulnerability as critical

Atlassian has been made aware of current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance.

Fix
We have taken the following steps to address this issue:

Released versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 and 7.18.1 which contain a fix for this issue…

Reply | Quote

Replies

Confluence is a document collaboration service.

The issue is in their self hosted offering, not their cloud service (apparently).

cheers, Paul

1 user thanked author for this post.

Alex5723

Reply | Quote