nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Workaround for CVE-2022-26134 - Windows version

Markus Sveinn Markusson

Confluence Windows version 7.7.2.

The workaround suggested by Atlassian includes the replacement of three files,

xwork-1.0.3-atlassian-10.jar
webwork-2.1.5-atlassian-4.jar
CachedConfigurationProvider.class

None of these files can be found in the Confluence directory tree.

Does this vulnerability apply to the Windows version, and if so, what would be the correct workaround?

Accepted answers

Andy Heinzer

Yes this vulnerability applies to Windows editions as well. The files you mentioned are the replacement files. Not the files that are currently on your system. You need to download those specific files you mentioned from the Advisory itself. Then remove the existing files with similar (but not exactly the same names). Then copy in the downloaded files to their appropriate locations. If you cannot find this folder, you might want to search for the

WEB-INF

folder instead. Two of the jar files will be found in the WEB-INF/lib/ directory.

All comments

Andy Heinzer

WEB-INF

folder instead. Two of the jar files will be found in the WEB-INF/lib/ directory.

Markus Sveinn Markusson

Thank you, Andy.

You are correct, the two .jar files have older version numbers, understandibly.

The CachedConfigurationProvider.class is nowhere to be found, though.

Regards,
Markus

Andy Heinzer

Yes, that is expected as well. That .class file has to added to a separate directory.

Change to directory <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup  
Create a new directory called webwork

Copy CachedConfigurationProvider.class into <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork
Ensure the permissions and ownership are correct for:
<confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork
<confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork/CachedConfigurationProvider.class

Markus Sveinn Markusson

Thank you very much, Andy. Workaround procedure completed.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server

windows

cve-2022-26134