Does this workaround also applies to LTS 7.13.5 although only version >7.15 are mentioned? Mitigation If you are unable to upgrade Confluence immediately, then as a temporary workaround, you can mitigate the CVE-2022-26134 issue by updating the following files for the specific version of the product. For Confluence 7.15.0 - 7.18.0 If you run Confluence in a cluster, you will need to repeat this process on each node. You don't need to shut down the whole cluster to apply this mitigation. * Shut down Confluence. * Download the following 1 file to the Confluence server: * xwork-1.0.3-atlassian-10.jar * Delete (or move the following JAR outside of the Confluence install directory): /confluence/WEB-INF/lib/xwork-1.0.3-atlassian-8.jar Do not leave a copy of this old JAR in the directory. * Copy the downloaded xwork-1.0.3-atlassian-10.jar into /confluence/WEB-INF/lib/ * Check the permissions and ownership on the new xwork-1.0.3-atlassian-10.jar file matches the existing files in the same directory. * Start Confluence.

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Workaround for CVE-2022-26134 and LTS 7.13.x

DWedekind

Does this workaround also applies to LTS 7.13.5 although only version >7.15 are mentioned?

Mitigation

If you are unable to upgrade Confluence immediately, then as a temporary workaround, you can mitigate the CVE-2022-26134 issue by updating the following files for the specific version of the product.

For Confluence 7.15.0 - 7.18.0

If you run Confluence in a cluster, you will need to repeat this process on each node. You don't need to shut down the whole cluster to apply this mitigation.

Shut down Confluence.
Download the following 1 file to the Confluence server:
- xwork-1.0.3-atlassian-10.jar
Delete (or move the following JAR outside of the Confluence install directory):
```
<confluence-install>/confluence/WEB-INF/lib/xwork-1.0.3-atlassian-8.jar
```
Do not leave a copy of this old JAR in the directory.
Copy the downloaded xwork-1.0.3-atlassian-10.jar into <span><confluence-install>/confluence/WEB-INF/lib/<br> </span>
Check the permissions and ownership on the new xwork-1.0.3-atlassian-10.jar file matches the existing files in the same directory.
Start Confluence.

Accepted answers

Andy Heinzer

There are different workarounds steps depending on your version. Those are the steps for 7.15 and higher versions. But the advisory also contains a different workaround steps for 7.0.0 - 7.14.x versions. Search for the phrase

For Confluence 7.0.0 - Confluence 7.14.2

and you will find slightly different mitigation steps for those versions.

All comments

Andy Heinzer

For Confluence 7.0.0 - Confluence 7.14.2

and you will find slightly different mitigation steps for those versions.

Venkata Mangipudi

Hi @Andy Heinzer we are using Confluence Server v. 7.4.11.
I have followed mitigation steps under "For Confluence 7.0.0 - Confluence 7.14.2".

After copying these files in respective directories, confluence app is not loading. Getting some errors in Catalina.out and atlassian-confluence.log.

Shall I open another case for it ? or could you help me?

Andy Heinzer

@Venkata Mangipudi Please create a technical support request by visiting https://support.atlassian.com/contact/ I recommend that you have a billing or technical contact of your Confluence server license open a support case. Otherwise users that are not listed within the SEN could be redirected back here to Community.

For startup problems like you have mentioned, it is important for our support teams to be able to gather those logs to help here.

Venkata Mangipudi

Will do that. Thanks Andy

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server

cve-2022-26134