CVE-2022-22965

[Frode Aasegaard]

Hi.

Considering to upgrade the onsite server version of Confluence to version 7.13.5 (long term).  I am however not sure if this security issue is fixed in this version.

Does anyone know if this version includes a fix for this security issue?

Thanks!

[Thiago Masutti · Accepted solution]

Hi @Frode Aasegaard 
I hope you are well.

Confluence on any version is vulnerable to CVE-2022-22965 on very specific conditions:

All the following pre-conditions must be met for successful exploitation:

• The product is running on JDK 9 or higher,

• An attacker tricks a user into making a malicious HTTP request,

• The request contains a valid Cross-Site Request Forgery token (note that the same-origin policy prevents an attacker from obtaining a user’s valid token),

• The targeted user is logged into the application with ‘system administrator’ privileges.

• Jira and Confluence only: The targeted user also has an active ‘secure administrator session’ (note that these sessions only last for 10 minutes by default).

The suggested workaround to mitigate possible problems is as follows

Customers with impacted on-premises products can downgrade from running JDK 9 or higher to JDK 8 or lower. This will eliminate the possibility of exploitation. These instructions can be used for changing the version of Java for Jira and Confluence:

• Jira: https://confluence.atlassian.com/jirakb/change-the-java-version-used-by-jira-server-765594330.html
• Confluence: https://confluence.atlassian.com/doc/change-the-java-vendor-or-version-confluence-uses-962342397.html

For further information about this CVE, please check https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html .

Kind regards,
Thiago Masutti

[Frode Aasegaard]

Thanks!