Atlassian Confluence Multiple Arbitrary File Upload Vulnerabilities

Bugtraq ID:	61170
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 15 2013 12:00AM
Updated:	Jul 15 2013 12:00AM
Credit:	Andrew Horton, Sow Ching Shiong, Mahendra
Vulnerable:	Atlassian Confluence 4.3.7 Atlassian Confluence 4.3.5
Not Vulnerable:

Atlassian Confluence Multiple Arbitrary File Upload Vulnerabilities

Atlassian Confluence is prone to multiple vulnerabilities that let attackers upload arbitrary files. These issues occur because the application fails to adequately sanitize user-supplied input.

An attacker may leverage these issues to upload arbitrary files to the affected computer; this can result in an arbitrary script code execution within the context of the affected site.

Atlassian Confluence 4.3.5 is vulnerable; other versions may also be affected.

Atlassian Confluence Multiple Arbitrary File Upload Vulnerabilities

An attacker can exploit these issues using a web browser.

Atlassian Confluence Multiple Arbitrary File Upload Vulnerabilities

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Atlassian Confluence Multiple Arbitrary File Upload Vulnerabilities

References:

• Atlassian Confluence Multiple Vulnerabilities (DS-2013-005) (BAE Systems)
  
• Atlassian Confluence Web Site (Atlassian)