from disclosure to weapon2 days
Action required by CISAfederal deadline: 2022-05-03
Apply updates per vendor instructions.
In short
Confluence has a flaw that allows users with upload permissions to write files anywhere on the server by manipulating file paths, potentially enabling them to execute harmful code.
Technical detail
Path traversal vulnerability in the downloadallattachments resource allows authenticated users with attachment upload or space creation privileges to write arbitrary files to the filesystem, leading to remote code execution through malicious file placement in executable directories.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Atlassian Confluence
In the same product, most dangerous first.