Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,296,828
Community Members
 
Community Events
165
Community Groups

Security Advisory for Confluence Server and Data Center, August 2021

This article is for a critical security vulnerability that exists in Confluence Server and Confluence Data Center.

We recommend that you upgrade to a fixed version as soon as possible to ensure that you are not affected. If you are unable to upgrade Confluence immediately, then apply the temporary workaround as mentioned in the advisory. Please see the full advisory to learn more and access the fixed versions:

If you have questions related to the advisory, upgrades, or migrations, please ask a new question here on Community. Please mention your question relates to CVE-2021-26084. Alternatively, you may comment on this article and we will convert your post to a question in order to best help you get an answer.

2 comments

We're running Confluence Server 7.4.9 and our [gear] -> User management page doesn't have anything about user signup options. There is no 'Allow people to sign up to create their account' setting on that page. 

Is there somewhere else we should be looking for this setting?

Hi @Colin Murtaugh

If you're running Confluence Server 7.4.9 then you're vulnerable to the issue outlined in the advisory, regardless of whether you allow people to signup to create their own account or not.

We've reworded the advisory (Confluence Security Advisory CVE-2021-26084 - OGNL injection - 2021-08-25) in the last few hours to remove any ambiguity regarding the user signup settings.  Regardless of that setting, Confluence 7.4.9 is still vulnerable via other endpoints.

As such, Atlassian recommends running the workaround/mitigation script even if 'Allow people to sign up to create their own account' is disabled.  There are several endpoints identified that expose Confluence to CVE-2021-26084, so applying the workaround script will temporarily mitigate against the known vulnerable end points until you can upgrade to a version that fixes this permanently.  In your case, upgrading to 7.4.11 is probably the easiest.  The issue is fixed in 7.4.11.

Hope this helps!

Comment

Log in or Sign up to comment
TAGS
Community showcase
Published in Confluence

Confluence: Where work and wellness meet

Feeling overwhelmed by the demands of work and life? With a 25% increase in the prevalence of anxiety and depression worldwide during the pandemic, for most of us, it’s a resounding yes . 🙋‍♀️ ...

1,053 views 19 29
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you