You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
We have some very old Confluence 2.10 servers running. Is it reasonable to assume that these are NOT impacted by the CVE-2022-26134 vulnerability based on the following statement in the CVE-2022-26134 document?
"Confluence Server and Data Center versions after 1.3.0 are affected."
Unfortunately, no. Even these very old versions are susceptible to this vulnerability. The Advisory itself does provide some mitigation steps for more recent versions. You might be able to reduce the risk by restricting network access to this Confluence application. But give the nature of a RCE (Remote code execution) type vulnerability, out of an abundance of caution, Atlassian still recommends upgrading these old versions to supported versions that contain this fix.
There are steps to follow in Upgrading Confluence Manually that explain the necessary versions to upgrade to in sequence. It would require multiple upgrades in order to get that data onto a supported platform.