QID 730425

Date Published: 2022-04-07

QID 730425: Atlassian Confluence Data Center Remote Code Execution (RCE) Vulnerability

Confluence Data Center is a self-managed solution that provides you with the additional configuration options you need to meet the collaboration needs of the most demanding teams.

Confluence Data Center.

Affected Versions:
All versions 5.6.x and later
QID Detection Logic(Unauthenticated):
It checks for vulnerable version of Atlassian Confluence using GET request to login.action page.

A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted JoinRequest, resulting in arbitrary code execution.

CVSS V3 rated as Critical - 8.1 severity.

CVSS V2 rated as High - 6.8 severity.

Solution

For more information please visit Confluence Security Advisory for remediation of this vulnerability.

Workaround:
Confluence Data Center is only affected when it is installed as a cluster. To verify whether a cluster installation is being used, check the confluence.cfg.xml file in the Confluence home directory. If the following line is present, it has been installed as a cluster: <PROPERTY NAME="confluence.cluster">true</PROPERTY> If the line is not present or if the value is set to false instead of true, it has not been installed as a cluster. Restrict access to the Hazelcast port by using a firewall or other network access controls. The port only needs to be accessible by other nodes in the Confluence. For Confluence Data Center, Hazelcast uses both TCP ports 5701 and 5801 by default.

Vendor References

Atlassian Confluence - confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html?utm_source=alert-email&utm_medium=email&utm_campaign=bitbucket-data-center-confluence-data-center-security-advisory-march_EML-12770&jobid=105489999&subid=1544944158

CVEs related to QID 730425

CVE-2016-10750 |

Software Advisories

Advisory ID	Software	Component	Link
CVE-2016-10750			confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html?utm_source=alert-email&utm_medium=email&utm_campaign=bitbucket-data-center-confluence-data-center-security-advisory-march_EML-12770&jobid=105489999&subid=1544944158

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].