Skip to content
OpenAdvisories
High WID-SEC-2024-1210 5 CVEs

Atlassian Confluence: Mehrere Schwachstellen

Published May 21, 2024 · Updated Jun 3, 2024 · Revision 2 · de-DE

Vendor: Atlassian Product: Confluence Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Confluence ausnutzen, um beliebigen Programmcode auszuführen, um vertrauliche Informationen offenzulegen und um einen Denial-of-Service-Zustand zu erzeugen.

Product

Confluence ist eine kommerzielle Wiki-Software.

Vulnerabilities 5

  • Critical 10.0
    CVE-2024-1597

    pgjdbc SQL Injection via line comment generation

    pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…

    pgjdbc pgjdbc trino trino-plugin-opensearch Debian Ubuntu Alpine Wolfi Maven
  • High 7.6
    CVE-2023-45859

    Missing permission checks on Hazelcast client protocol

    In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.

    com.hazelcast:hazelcast com.hazelcast:hazelcast-all Maven
  • High 7.5
    CVE-2024-24549 Public exploit EPSS 23%

    Apache Tomcat: HTTP/2 header handling DoS

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • High 7.2
    CVE-2024-21683 Public exploit Scanner template EPSS 88%

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center an…

    Atlassian Confluence Data Center Web / CMS
  • Medium 6.3
    CVE-2024-23672

    Apache Tomcat: WebSocket DoS with incomplete closing handshake

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

Revision history

  1. #2

    PoC aufgenommen

  2. #1

    Initiale Fassung

References