Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Confluence ausnutzen, um einen Denial of Service Angriff durchzuführen und die Authentisierung zu umgehen.
Product
Confluence ist eine kommerzielle Wiki-Software.
Vulnerabilities 2
-
High 7.5
Netplex Json-smart Uncontrolled Recursion vulnerability
A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issu…
-
High 7.4
CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Revision history
-
#1
Initiale Fassung
References
-
Atlassian Security Bulletin vom 2025-06-17
https://confluence.atlassian.com/security/security-bulletin-june-17-2025-1574012717.html
-
PoC CVE-2024-57699
https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699