RCE (Remote Code Execution) in Confluence Data Center and Server - CVE-2022-1471

h2. Summary of Vulnerability

Multiple Atlassian Data Center and Server Products use the SnakeYAML library for Java, which is susceptible to a deserialization flaw that can lead to RCE (Remote Code Execution).

(i) Atlassian Cloud sites are not affected by this vulnerability. If your site is accessed via an [atlassian.net|http://atlassian.net/] domain, it is hosted by Atlassian and is not vulnerable to this issue.
h2. Affected Versions
||Product||Affected Versions||
|Confluence Data Center
Confluence Server| - 6.13.x

• 6.14.x
• 6.15.x
• 7.0.x
• 7.1.x
• 7.2.x
• 7.3.x
• 7.4.x
• 7.5.x
• 7.6.x
• 7.7.x
• 7.8.x
• 7.9.x
• 7.10.x
• 7.11.x
• 7.12.x
• 7.13.0
• 7.13.1
• 7.13.2
• 7.13.3
• 7.13.4
• 7.13.5
• 7.13.6
• 7.13.7
• 7.13.8
• 7.13.9
• 7.13.10
• 7.13.11
• 7.13.12
• 7.13.13
• 7.13.14
• 7.13.15
• 7.13.16
• 7.13.17
• 7.14.x
• 7.15.x
• 7.16.x
• 7.17.x
• 7.18.x
• 7.19.0
• 7.19.1
• 7.19.2
• 7.19.3
• 7.19.4
• 7.19.5
• 7.19.6
• 7.19.7
• 7.19.8
• 7.19.9
• 7.20.x
• 8.0.x
• 8.1.x
• 8.2.x
• 8.3.0|
  h2. Fixed Versions
  ||Product||Fixed Versions||
  |Confluence Data Center
  Confluence Server|Patch to the following fixed versions or later
  7.19.17 (LTS)
  8.4.5
  8.5.4 (LTS)
  8.6.2 (Data Center Only)
  8.7.1 (Data Center Only)
   
  Fixed in the following versions
  The fix is contained in 7.13.20, 7.19.10, and 8.3.1, however these versions also contain [previously communicated security vulnerabilities|https://www.atlassian.com/trust/data-protection/vulnerabilities].
   |
  h2. What You Need to Do

Atlassian recommends that you upgrade your instance to one of the versions listed in the “Fixed Versions” table section of this ticket. For full descriptions of the above versions of Confluence Data Center and Server, see the [release notes|https://confluence.atlassian.com/doc/confluence-release-notes-327.html]. You can download the latest version of Confluence Data Center and Server from the [download center|https://www.atlassian.com/software/confluence/download-archives].

For additional details, please see the [full advisory.|https://confluence.atlassian.com/pages/viewpage.action?pageId=1296171009]