nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

CVE-2022-26134 Clarification

Frank Alvarado_e03dsl

For my understanding, the vulnerability description states that this is an unauthenticated attack. What impact, if any, would disabling anonymous access to confluence have on this vulnerability? would it preclude an attacker from being able to exploit this vulnerability?

Accepted answers

Andy Heinzer

Hi Frank,

Yes this is an unauthenticated remote code execution vulnerability, as per the Confluence Security Advisory page for CVE-2022-26134. Confluence instance(s) are vulnerable regardless of the authentication mechanisms currently configured.

Disabling anonymous access does not provide sufficient means to mitigate this vulnerability.

If you could truly remove your site from the internet, then you might reduce the risk involved. However at this time we have released patched versions. We recommend upgrading to a fixed version as soon as possible. If you are unable to upgrade immediately, then please review the current mitigations steps in the advisory itself.

Andy

All comments

Andy Heinzer

Hi Frank,

Disabling anonymous access does not provide sufficient means to mitigate this vulnerability.

Andy

Frank Alvarado_e03dsl

Andy,

Thanks a bunch, this is exactly what I was thinking.

fidel dali_jtmcri

Hello, what about old versions like 5.10, suddently we all have to upgrade? are you working on a patch for mayor versions like 5.x , 6.x ?

thanks

Andy Heinzer

@fidel dali Those versions are at End Of Life (EOL). Please see our EOL policy, it explains that we do not offer support on these EOL versions.

Based on the upgrading documentation guide, if the software maintenance period included in your license has expired, you can keep using Confluence, but you'll need to renew before you can upgrade.

If we attempt a Confluence upgrade with an expired license, we can run into the issue outlined here:

Upgrading Beyond Current Licensed Period

There are some options to proceed and restore Confluence functionality.

Head to https://my.atlassian.com to renew your license or purchase a new license and follow the steps on this guide to fix the license and restore access to Confluence.
Revert the upgrade by restoring Confluence to the previous version using the steps outlined here and apply the CVE workaround immediately to keep Confluence safe.

We strongly recommend upgrading Confluence on a separate staging environment first to validate the upgrade and ensure proper testing before upgrading production.

Rob Horan

Forgive the basic question, but how does an attacker use this to gain access to the entire system? Assuming they are running on a Linux-based OS, wouldn't Confluence be running as a dedicated user, and not one with root-level privs?

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server

cve-2022-26134