SharePoint Connector Security Advisory 2010-11-29

On this page

Still need help?

The Atlassian Community is here for you.

Ask the community

In this advisory:

Security Vulnerability in Confluence Permission Checker RPC Plugin

Severity

Atlassian rates the severity level of this vulnerability as high, according to the scale published in Severity Levels for Security Issues. The scale allows us to rank the severity as critical, high, moderate or low.

Risk Assessment

We have identified and fixed a vulnerability in the Permission Checker RPC plugin, which is installed by default on all Confluence instances running the SharePoint Connector for Confluence. This vulnerability allows an attacker to access the wiki markup and/or rendered HTML of all Confluence pages in all spaces, even if permissions are applied which would only allow access to a specific sub-set of users.

Vulnerability

The table below describes the versions of the Permission Checker RPC plugin and SharePoint Connector affected by the vulnerability.

Confluence Feature

Affected Permission Checker RPC Plugin Versions

Affected SharePoint Connector Versions

Fixed Permission Checker RPC Plugin Version

Issue Tracking

Global, space and page-level permissions

1.0 – 1.2.1

1.0 – 1.2.1

1.2.2

CSI-677

Risk Mitigation

We recommend that you upgrade your Permission Checker RPC plugin to the latest version in order to fix this vulnerability.

We strongly advise that you disable the remote API until your Confluence instance is patched or upgraded. If the remote API is vital, we recommend you disable anonymous access to the remote API.

We also recommend that you read our guidelines on best practices for configuring Confluence security.

Fix

Version 1.2.2 of the Permission Checker RPC plugin fixes this issue. You can download this version from the Atlassian Plugin Exchange. Alternatively, you can install the latest version of the plugin through the Confluence Administration Console. See the guide to installing plugins.

Last modified on Nov 28, 2010

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.