Lucene search

[email protected]CVE-2023-22503

HistoryMay 01, 2023 - 5:15 p.m.

CVE-2023-22503

2023-05-0117:15:08

[email protected]

web.nvd.nist.gov

atlassian

confluence

cve-2023-22503

information disclosure

vulnerability

security

atlassian confluence server

atlassian confluence data center

remote attack

nvd

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.0%

JSON

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature.

This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team.

The affected versions are before version 7.13.15, from version 7.14.0 before 7.19.7, and from version 7.20.0 before 8.2.0.

Affected configurations

NVD

Node

atlassianconfluence_data_centerRange<7.13.15

atlassianconfluence_data_centerRange7.14.0–7.19.7

atlassianconfluence_data_centerRange7.20.0–8.2.0

atlassianconfluence_serverRange<7.13.15

atlassianconfluence_serverRange7.14.0–7.19.7

atlassianconfluence_serverRange7.20.0–8.2.0

CPENameOperatorVersion
atlassian:confluence_data_centeratlassian confluence data centerlt7.13.15
atlassian:confluence_data_centeratlassian confluence data centerlt7.19.7
atlassian:confluence_data_centeratlassian confluence data centerlt8.2.0
atlassian:confluence_serveratlassian confluence serverlt7.13.15
atlassian:confluence_serveratlassian confluence serverlt7.19.7
atlassian:confluence_serveratlassian confluence serverlt8.2.0

CPE	Name	Operator	Version
atlassian:confluence_data_center	atlassian confluence data center	lt	7.13.15
atlassian:confluence_data_center	atlassian confluence data center	lt	7.19.7
atlassian:confluence_data_center	atlassian confluence data center	lt	8.2.0
atlassian:confluence_server	atlassian confluence server	lt	7.13.15
atlassian:confluence_server	atlassian confluence server	lt	7.19.7
atlassian:confluence_server	atlassian confluence server	lt	8.2.0

CNA Affected

[
  {
    "vendor": "Atlassian",
    "product": "Confluence Data Center",
    "versions": [
      {
        "version": "< 7.20.2",
        "status": "unaffected"
      },
      {
        "version": ">= 7.20.2",
        "status": "affected"
      },
      {
        "version": ">= 7.13.5",
        "status": "unaffected"
      },
      {
        "version": ">= 7.19.7",
        "status": "unaffected"
      },
      {
        "version": ">= 8.20.0",
        "status": "unaffected"
      }
    ]
  },
  {
    "vendor": "Atlassian",
    "product": "Confluence Server",
    "versions": [
      {
        "version": "< 7.20.2",
        "status": "unaffected"
      },
      {
        "version": ">= 7.20.2",
        "status": "affected"
      },
      {
        "version": ">= 7.13.5",
        "status": "unaffected"
      },
      {
        "version": ">= 7.19.7",
        "status": "unaffected"
      },
      {
        "version": ">= 8.20.0",
        "status": "unaffected"
      }
    ]
  }
]