Daniel Eads Atlassian Team

Hey Sergey, welcome to the Atlassian Community. Unfortunately from the CPU load you're seeing and the timeframe you mentioned, I believe your instance was affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen…

Hey Keith, welcome to the Atlassian Community! First of all, thank you for providing so much detail in your question. This is the kind of information that is extremely helpful in troubleshooting, and I really appreciate that you took the time to include it all. Unfortunately from the CPU load you're seeing and the…

Hi Viacheslav, This is a good question, thanks for considering intermediate upgrades! With recent release of Confluence, there are no intermediate releases to worry about. We usually post these in the release notes for reach version if there is a particular version we need you to upgrade to before continuing to your final…

Given some info in the video Ryan recorded, I think the problem is related to an attack against a vulnerability that's been circulating. I've answered comprehensively in Ryan's second ask of this question.

Hi Ryan, Thanks for the video - that helps show exactly what's going on. You mentioned this has been happening for the last three days - I also see you asked a couple days ago but didn't get an answer. Given the timeframe, I believe your instance was affected by an opportunistic attack against the CVE-2019-3396 Widget…

Hi Philippe, welcome to the Community! The advisory is not platform-specific. No matter what operating system Confluence is installed on, the path traversal vulnerability in the downloadallattachments resource exists as described in the advisory. Our advice for all users running on affected versions of Confluence (no…

Hi Kanwar, Confluence 7.0 is currently in Early Access. We don't publish release dates for our Server products, but you can see the history of our release cadence for Early Access versions on the page that has info about the Early Access Program. I hope that helps! Cheers, Daniel | Atlassian Support

Hi Jonatan, We don't recommend trying to upgrade Tomcat separately from Confluence. While the most recent Confluence release (6.15.2) bundles Tomcat 9.0.12, the default setup of Tomcat that Confluence ships with is not in a state that is affected by CVE-2019-0232. It is possible that the Tomcat setup could be affected, but…

P.S. if this instance is exposed to the internet, you'll want to consider upgrading to Confluence 6.15.2 or above as we released a security advisory today that affects 6.8.x versions of Confluence: https://confluence.atlassian.com/doc/confluence-security-advisory-2019-04-10-968660855.html

Hey Miroslav, I understand you're getting stuck trying to get Confluence to launch even though you've got a valid license. There is a process for entering it manually in a configuration file you can try to work around this. We've got the process documented in this knowledgebase article. In short, it wants you to create a…

Hey Neven, A quick run through your manifest shows Confluence only has 1GB of allocated heap. This might be the cause of some woes - increasing to 2G or above is probably a good start. Have a look at https://github.com/Bonn93/atlassian-kubernetes which has a Confluence manifest that you can reference. While Atlassian…

Based on the Tomcat version listed in your log output, I can infer you are on a version of Confluence we are concerned about as part of a security issue. From what's in your logs, it sounds like your instance was affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th…

Hi Imran, What operating system are you running? We don't recommend running Confluence on port 80 in Linux as it would require Tomcat to run as root, which is a security risk. Instead, we recommend running Confluence behind a reverse proxy such as Apache or nginx (setup guides here). The active connectors in your…

Hey Viktor, Based on your symptoms and Confluence version (6.11.2), it sounds like your instance was affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen an infection going around that injects malware and the…

Hey Philip, If I understand correctly, you're looking to change the name of an add-on (that you are developing, correct?) in Jira Cloud so that it shows differently than the lower-case username that it currently has. Is that right? Based on my current understanding, the name property in the app descriptor is used for the…

Hey Agar, welcome to the Community! I wouldn't expect enabling TLS in outgoing mail (SMTP) to cause the "From:" name to change. Do you notice that with TLS disabled, using plain non-encrypted SMTP over port 25 that the same issue occurs? If possible, would you be able to provide the part of the email headers that show the…

Hey David, Welcome to the Atlassian Community! I see your ticket has gone unanswered for a while and just wanted to touch base for a pointer. Most folks on this Community are users or admins rather than developers, so it's usually a little more rare to see someone able to answer development-related questions like this. We…

Hey Robert, I've just tested on Confluence 6.15.2 (instructions apply to older versions as well) and here's how you do this step-by-step: * Click the '...' menu in the upper right of the page you want to copy and select the Copy option * Select the new parent space and homepage, and ensure "Include child pages" is checked,…

Hey Mike! I've checked your license to confirm that you have Select Support. Priority Support for Server and Premier Support both have separate SENs that you would see in my.atlassian.com if you are listed as a contact for those support offerings. Just to double check for your specific case, I also confirmed that there…

Hi @Niveditha , I can 100% confirm that all versions of 6.0.x are affected. The omission from the advisory is an error on our end, which we will correct shortly. The impacts are outlined on the advisory itself: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A…

Hey John, Thanks for raising these concerns. I do see an existing suggestion on jira.atlassian.com about changing the status codes on some returns: CONFSERVER-55343 - feel free to add a comment to the ticket with the additional context here since it's not a 1:1 match with what you've brought up. For most customers, getting…

I've tried a couple of things to get the system running again and it appears that there was a security breach. I found processes in /tmp with random character names running as the confluence user. Yes, this was my suspicion but wanted to confirm you were on a vulnerable version before throwing a bunch of information at…

Hi, welcome to the Community! We have a SQL query documented that will help you out here. There's a short article about it in the Atlassian knowledgebase, but it will return the pages with the most number of edits sorted descending. We provide these in PostgreSQL, so you might need to make some syntax tweaks if your…

Hi Rakesh, This looks like the type of domain parking screen you see if your domain name registration has expired. Are you trying to access Confluence via a domain name (like "yourdomain.com") and is the registration for that site still valid? You can check a domain's status by using the official ICANN whois tool. Cheers,…

Hey Arnis, I've checked your license details and found that your maintenance expired before any of the patched versions we're recommending were released. You can upgrade Confluence, but it will immediately prevent you from adding new pages or making edits and tell you that you've upgraded to a version you don't have a…

Based on your symptoms, it sounds like your instance was affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen an infection going around that injects malware and the bitcoin miner it tries to run uses all the…

Hi Rich, A couple questions that will help us check and see which direction to start looking: * What version of Confluence do you have? * Is the CPU on the box abnormally high right now? Thanks, Daniel | Atlassian Support

Based on your version of Confluence (6.0.1) and symptoms, it sounds like your instance was affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th (see Confluence Security Advisory - 2019-03-20). We've seen an infection going around that injects malware and the bitcoin…

Yes, I can confirm that those tests failing are the result of the initial SSL connection not being trusted. From the System Information page in Confluence, can you check what it's got listed for JAVA_HOME? That's the path Confluence thinks it's using as its JRE, and if it's something like ".../confluence/jre/bin" then it's…

Hey Thomas, Looks like you have a starter license (10 users) right now. In order to open a ticket at support.atlassian.com, you'd need to bump up to the 25 user license. We support starter licenses exclusively through Community. I have sent your thread over to a teammate to review soon. I see that another Community member…