Does CVE-2023-22518 impact Confluence 5.8.2

Craig Goldsmith

We are very close to migrating off a old legacy Confluence instance that is currently running 5.8.2. It's internally hosted and limited to only intranet access, so no public access. 

 

I wanted to confirm 5.8.2 is impacted by CVE-2023-22518 and if so is this mitigation still applicable to our environment. 

Thanks.  

==================

Mitigation

      This is possible at the network layer or by making the following changes to Confluence configuration files.

1. On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>                 <web-resource-collection>                          <url-pattern>/json/setup-restore.action</url-pattern>                          <url-pattern>/json/setup-restore-local.action</url-pattern>                          <url-pattern>/json/setup-restore-progress.action</url-pattern>                          <http-method-omission>*</http-method-omission>                 </web-resource-collection>         <auth-constraint /></security-constraint>

2. 
   2. Restart Confluence.

 

Marc -Devoteam-

Hi @Craig Goldsmith 

Welcome to the community.

As stated in the CVE (https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html ) 

Not connecting your instance to the internet (no public access) will make your instance not vulnerable.

See point 2 in mitigation.

The configuration file changes are only applicable to point 3 in the mitigation section.

SO in relation that your are not externally able to access Confluence, mitigation point 2will apply to your instance