Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

CVE-2020-13936 Security issues

We recently discovered that cVE-2020-13936 (Velocity-1.6.4) is in the latest stable version. We want to know if you have a plan to deal with this.

3 answers

3 votes

Confluence doesn't have "stable" versions, it has versions that are released because they work.

On top of that, the problem here is "This applies to applications that allow untrusted users to upload/modify velocity templates"

Confluence doesn't do that.  It's code change (requiring root access to your Confluence server), or being sneaky in user macros (server only, and Confluence admins only).

As you have to trust your admins, with any software, this is not a problem.  Untrusted users can't make any form of attack.

0 votes

Hey @zhangyifei 

A good check to see if a product is impacted by a CVE is to search JAC - eg: https://jira.atlassian.com/issues/?jql=text%20~%20%22CVE-2020-13936%22

It's no guarantee, but it is an indicator 

CCM

0 votes
Pramodh M Community Leader Jan 10, 2022

Thanks @Nic Brough _Adaptavist_ 

Hi @zhangyifei 

Upgrade the confluence version to latest stable release, if they do have CVE you mentioned that should be solved,

And FYI if any CVE are found for any Atlassian applications, team will notify customers to upgrade the server

Here's the release notes of latest stable version of confluence

https://confluence.atlassian.com/conf713/confluence-release-notes-1077914914.html

Thanks,

Pramodh

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Confluence Cloud

🏠 Say hello to the new Confluence Home!

Hi Atlassian Community, My name is DJ Chung, and I’m a Product Manager on the Confluence Cloud team. Today, I’m excited to share a new and improved version of Home. The new Home helps you ...

1,068 views 8 43
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you