Confluence Security Advisory 2009-01-07
In this advisory:
Content Overwrite Vulnerability in the Office Connector Plugin
Atlassian rates this vulnerability as high, according to the scale published in Confluence Security. The scale allows us to rank a vulnerability as critical, high, moderate or low.
We have identified a risk that makes it possible for users with read-only access to a Confluence wiki space to modify its contents via the document import feature of the Office Connector plugin. This issue, however, does not expose restricted content on a Confluence wiki space to unauthorised users.
Please see the 'Fix' section below. If you cannot apply the fix immediately, you can consider taking one or more of the following steps:
- Disable the whole Office Connector plugin, as explained in Disabling and enabling apps.
- If you judge it necessary, you can disable public access (e.g. anonymous access and public signup) to your wiki until you have applied the necessary patch or upgrade.
- For even tighter control, you could restrict access to trusted groups.
The Office Connector plugin was first bundled in Confluence version 2.10.0. Hence, this vulnerability affects Confluence 2.10.0 where the Office Connector Plugin is enabled. Additionally, this plugin is compatible with all versions of Confluence from 2.3.0 onwards. Hence, if you have installed the plugin, this vulnerability will affect your Confluence instance.
Please download and install the latest version of the Office Connector plugin using the Universal Plugin Manager (instructions here). If you wish to install this plugin manually, you can download it from here.
For more information, please refer to CONF-14014.
Our thanks to Justin Wong, who reported this vulnerability. We fully support the reporting of vulnerabilities and we appreciate it when people work with us to identify and solve the problem.