The cwd_application and cwd_app_dir_mapping tables are empty

[arthurnurislamov]

Hello,

I really need your help on this as I'm getting desperate.

Yesterday I got an unable to login error message and followed the advice provided by the community.

All my tables for some reason turned out to be emty: 

• cwd_app_dir_group_mapping             
• cwd_app_dir_mapping                   
• cwd_app_dir_operation 

So, I followed "Unable to Log In to Confluence after an XML restore" advice at https://confluence.atlassian.com/confkb/unable-to-log-in-to-confluence-715261580.html

Although, I didn't do any XML restore.

I was able to create the admin/admin user successfully. Then I linked confluence back to Jira for user management.

Now the trouble is that all of the spaces are gone and I don't know how to get them back.

Is there anything I can do to recover them?

Thank you for support.

Arthur

[Ravina]

Hi @arthurnurislamov What confluence version you are currently running on and does your Confluence instance has internet connectivity as in last month Atlassian has reported two critical CVE which require a upgrade to the fixed version.

Please check the versions affected by the CVE's

This was reported in Oct 4th and some versions are affected with this. https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html

This one reported Oct31st and all versions are affected with it and need to update the Confluence to mitigate the same.

https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html

If your instance is on affected version then there might be possibility that your instance is compromised by the external user and deleted all the application data.

Thanks

Ravina

[arthurnurislamov]

Thank you Ravina!

I checked our version and yes, it could have been compromised. 

[Ravina]

Ahh, Check the  server file system if there are any recent files created and any suspicious files in the you found.

[arthurnurislamov]

I tried recovering from a backup, but the process always returns an error. I guess we will have to do a full system recovery, unfortunately. 

Thank you for your support!

[Ravina]

Yes, restore the old backup which was created before this incident happen and make sure you upgrade the instance to fixed version to make your instance secure.

Also, if you feel my input help you please accept the answer as this help grow my Atlassian profile.