CVE-2022-26134 - Confluence Server and Data Center versions after 1.3.0 are affected. ?

[Ken Fyten]

We have some very old Confluence 2.10 servers running. Is it reasonable to assume that these are NOT impacted by the CVE-2022-26134 vulnerability based on the following statement in the CVE-2022-26134 document?

"Confluence Server and Data Center versions after 1.3.0 are affected."

Thanks.

[Andy Heinzer]

Unfortunately, no.  Even these very old versions are susceptible to this vulnerability.  The Advisory itself does provide some mitigation steps for more recent versions.  You might be able to reduce the risk by restricting network access to this Confluence application. But give the nature of a RCE (Remote code execution) type vulnerability, out of an abundance of caution, Atlassian still recommends upgrading these old versions to supported versions that contain this fix.

[Ken Fyten]

Yeah, the problem is we recently evaluated what it would take to migrate to the current cloud release and it involved about a 4 version step process, not something we can do quickly or easily.

[Ken Fyten]

What would our migration path look like  in order to get from our current 2.10.3 Confluence to the min. spec supported version that is patched?

[Andy Heinzer]

There are steps to follow in Upgrading Confluence Manually that explain the necessary versions to upgrade to in sequence.  It would require multiple upgrades in order to get that data onto a supported platform.