The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

This advisory discloses a **critical** security vulnerability that exists in all versions of Confluence up to and including 4.1.9.

*   **Customers** **who have downloaded and installed Confluence** should upgrade their existing Confluence installations to fix this vulnerability.  
*   **Enterprise Hosted customers** need to request an upgrade by raising a support request at http://support.atlassian.com in the "Enterprise Hosting Support" project.
*   **JIRA Studio and Atlassian OnDemand customers** are not affected by any of the issues described in this advisory.

Atlassian is committed to improving product security. The vulnerability listed in this advisory has been discovered by Atlassian, unless noted otherwise. The reporter may also have requested that we do not credit them.   

If you have questions or concerns regarding this advisory, please raise a support request at http://support.atlassian.com/.

**In this advisory:**

**Critical XML Parsing Vulnerability****Severity**

Atlassian rates the severity level of this vulnerability as **crit****ical**, according to the scale published in Severity Levels for Security Issues. The scale allows us to rank the severity as critical, high, moderate or low.

This is an independent assessment and you should evaluate its applicability to your own IT environment.

**Description**

We have identified and fixed a vulnerability in Confluence that results from the way third-party XML parsers are used in Confluence. This vulnerability allows an attacker to:

*   execute denial of service attacks against the Confluence server, or  
    
*   read all local files readable to the system user under which Confluence runs.

The attacker does not need to have an account with the affected Confluence instance.

All versions of Confluence **up to and including 4.1.9** are affected by this vulnerability. This issue can be tracked here: CONF-25077 - Getting issue details... STATUS

The Gliffy for Confluence plugin is also vulnerable to this exploit. If you are using the Gliffy plugin for Confluence with _any_ version of Confluence, you will need to upgrade it (see 'Fix' section below) or disable it.

**Risk Mitigation**

We recommend that you upgrade your Confluence installation to fix this vulnerability.

Alternatively, if you are not in a position to upgrade immediately, you should do **all** of the following until you can upgrade. Please note, these measures will only limit the impact of the vulnerability, they will not mitigate it completely.  

*   Disable access to the SOAP and XML-RPC APIs, if these remote APIs are not required. Note, remote API access is disabled by default. See enabling remote APIs for instructions.  
    Disable the following plugins/plugin modules (see Disabling and enabling apps):  
    *   Office Connector plugin
    *   JUnitReport macro module of the confluence-advanced-macros plugin (called "Advanced Macros" in the interface)  
        
    *   confluence-jira3-macros plugin (called "JIRA Macros" in the interface)  
        
    *   WebDAV
*   Disable public access (such as anonymous access  and public signup) to Confluence until you have upgraded.
*   Ensure that your Confluence system user is restricted as described in best practices for configuring Confluence security.

**Fix**

**Upgrade** 

1.  Upgrade to Confluence 4.2 or later which fixes this vulnerability. For a full description of this release, see the Confluence 4.2 Release Notes. The following releases have also been made available to fix these issues in older Confluence versions.  You can download these versions of Confluence from the download centre.   
      
    *   Confluence 4.1.10 for Confluence 4.1 
    *   Confluence 4.0.7 for Confluence 4.0 
    *   Confluence 3.5.17 for Confluence 3.5
2.   Upgrade the following Confluence third-party plugins, if you are using them. The table below describes which version of the plugin you should upgrade to, depending on your Confluence version. See Updating Add-ons for instructions on how to update a plugin. 
    
    Plugin
    
    Confluence 4.2
    
    Confluence 4.1
    
    Confluence 4.0
    
    Confluence 3.5
    
    Gliffy plugin for Confluence
    
    4.2
    
    4.2
    
    4.2
    
    4.2
    

**Patches**  

There are no patches available for this vulnerability. Due to the extent of the changes required to fix the vulnerability, it is not possible to provide patches that resolve the issue without compromising the reliability of Confluence. You must upgrade to fix this vulnerability.

CVE-2012-2928: Confluence Security Advisory 2012-05-17 | Confluence Data Center and Server 7.17

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."

Tag

#jira