PT-2023-2589 · Atlassian · Confluence

Rojan Rijal · Published 2023-01-01 · Updated 2024-10-01 · CVE-2023-22503

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server versions prior to 7.13.15 Atlassian Confluence Server versions 7.14.0 through 7.19.7 Atlassian Confluence Server versions 7.20.0 through 8.2.0 Atlassian Confluence Data Center versions prior to 7.13.15 Atlassian Confluence Data Center versions 7.14.0 through 7.19.7 Atlassian Confluence Data Center versions 7.20.0 through 8.2.0

Description The issue is related to insufficient protection of service data in the macro preview feature of Atlassian Confluence Server and Data Center. This allows anonymous remote attackers to view the names of attachments and labels in a private Confluence space via an Information Disclosure vulnerability. The vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team.

Recommendations For versions prior to 7.13.15, update to version 7.13.15 or later. For versions 7.14.0 through 7.19.7, update to version 7.19.7 or later. For versions 7.20.0 through 8.2.0, update to version 8.2.0 or later. As a temporary workaround, consider restricting access to the macro preview feature until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-02405

CVE-2023-22503

Affected Products

Confluence

References · 9

• https://jira.atlassian.com/browse/CONFSERVER-82403 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22503 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02405 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22503 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22503 · Security Note
• https://vuldb.com/ru/?id.227797 · Note
• https://t.me/cvenotify/49564 · Telegram Post
• https://t.me/cvenotify/96721 · Telegram Post
• https://t.me/cibsecurity/63138 · Telegram Post