nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

in regards to Confluence Security Advisory - 2021-08-25

Jason Ferris

Hello,

Quick question. We do do not have this checkbox checked in our Confluence regarding the vulnerability. Does this mean the temporary workaround does not have to be implemented or should it be ran regardless? We are not able to update Confluence at this time but will in the future here.

Just checking before I shrug this one off. If I need to implement the temporary workaround regardless, I can do that.

Thank you!

Accepted answers

Malcolm Ninnes

Hey there @Jason Ferris

Atlassian recommends running the workaround script even if 'Allow people to sign up to create their own account' is disabled. There are several endpoints identified that expose Confluence to CVE-2021-26084, so applying the workaround script will temporarily mitigate against the known vulnerable end points until you can upgrade to a version that fixes this permanently.

We've reworded the advisory (Confluence Security Advisory CVE-2021-26084 - OGNL injection - 2021-08-25) to remove any ambiguity.

Hope this helps!

All comments

Kian Stack Mumo Systems

My reading of the vulnerability would be that you do not need to worry if the feature is not enabled, but I would double check that before deciding not to upgrade. Several people have asked the same question on this ticket, so I would add yourself as a watcher to see any response from Atlassian.

Malcolm Ninnes

Hey there @Jason Ferris

We've reworded the advisory (Confluence Security Advisory CVE-2021-26084 - OGNL injection - 2021-08-25) to remove any ambiguity.

Hope this helps!

Kian Stack Mumo Systems

Thanks for following up @Malcolm Ninnes!

Jason Ferris

@Malcolm Ninnes Thank you very much for the confirmation! I will go ahead and implement the workaround.

Jason Ferris

@Kian Stack Mumo Systems Thank you! Seems like you do have to run workaround even if not checked per Malcolm.

Vedant Kulkarni_Trundl

@Kian Stack Mumo SystemsDoes this vulnerability issue have an impact on Confluence running behind the VPN? Some of the customers have not exposed their Confluence publicly.

Kian Stack Mumo Systems

@Vedant Kulkarni_Trundl,

I would still perform the upgrade. The security vulnerability is less likely to exploited if your instance is behind a firewall, but it is still a big vulnerability that should be taken care of.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server

cve

cve-2021-26084