Atlassian · Confluence · CVE-2024-29131
**Name of the Vulnerable Software and Affected Versions**
Apache Commons Configuration versions 2.0 through 2.10.0
Atlassian Confluence Data Center versions 7.17.0 through 8.9.0
Atlassian Confluence Server versions 7.17.0 through 8.5.8
**Description**
The issue is related to an out-of-bounds write vulnerability in the Apache Commons Configuration library, specifically in the `AbstractListDelimiterHandler.flattenIterator()` function. This vulnerability can be exploited by a remote attacker to execute arbitrary code using specially crafted data. The vulnerability can cause a stack overflow, leading to a denial of service condition.
**Recommendations**
Apache Commons Configuration versions 2.0 through 2.10.0: Upgrade to version 2.10.1.
Atlassian Confluence Data Center versions 7.17.0 through 8.9.0: Upgrade to version 8.9.1 or the latest version.
Atlassian Confluence Data Center versions 8.5.0 through 8.5.8: Upgrade to version 8.5.9 LTS or 8.9.1.
Atlassian Confluence Server versions 7.17.0 through 8.5.8: Upgrade to version 8.5.9 LTS or the latest version.
Atlassian Confluence Data Center and Server versions prior to 7.17.0: Upgrade to version 8.9.1, 8.5.9 LTS, or 7.19.23 LTS.