Impact of CVE-2023-51467 on Jira/Confluence

[Ana Martinez Arroyo]

Hello, 

We use Jira et Confluence Data Center. 

I saw the vulnerability CVE-2023-51467, regarding to Apache OFBiz. Our Atlassian Products are impacted? Do they use Apache OFBiz? 

Thanks! 

[Admin Jira]

Hello Ana,

The editor has given a response :

Jira DC
Jira DC uses Atlassian's fork of the Entity Engine module of the Apache OfBiz project. We use only the Entity Engine module, while the vulnerability is in the framework module.

Confluence DC
Confluence does not use the Apache OfBiz library and is not vulnerable to this vulnerability.

Regards.

Abdel.

[dominikmaier]

Hello Abdel,

Does this also apply to Jira/Confluence Server Version?

Best,

Dominik

[PIERSON Cédric]

Dear all, 

I receive a message from my company to solve this issue.

Can you confirm that server version is impacted ? 

even if we will use DC licenses after the 15th february, I need to know if this issue impact Jira and Confluence Server.

Regards,

Cédric