CVE-2022-26134 Clarification
Asked by Frank Alvarado:

For my understanding, the vulnerability description states that this is an unauthenticated attack. What impact, if any, would disabling anonymous access to confluence have on this vulnerability? would it preclude an attacker from being able to exploit this vulnerability?


Answers:
author: Andy Heinzer
body: Hi Frank,

Yes this is an unauthenticated remote code execution vulnerability, as per the [Confluence Security Advisory page for CVE-2022-26134](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html). Confluence instance(s) are vulnerable regardless of the authentication mechanisms currently configured.

Disabling anonymous access does not provide sufficient means to mitigate this vulnerability.

If you could truly remove your site from the internet, then you might reduce the risk involved. However at this time we have released patched versions. We recommend upgrading to a fixed version as soon as possible. If you are unable to upgrade immediately, then please review the current mitigations steps in the advisory itself.

Andy

comments: author: Frank Alvarado
body: Andy,

Thanks a bunch, this is exactly what I was thinking.


author: fidel dali
body: Hello, what about old versions like 5.10, suddently we all have to upgrade? are you working on a patch for mayor versions like 5.x , 6.x ?

thanks


author: Andy Heinzer
body: [@fidel dali](/t5/user/viewprofilepage/user-id/4958112) Those versions are at End Of Life (EOL). Please see our [EOL policy](https://confluence.atlassian.com/support/atlassian-support-end-of-life-policy-201851003.html), it explains that we do not offer support on these EOL versions.

Based on the [upgrading documentation guide](https://confluence.atlassian.com/doc/upgrading-confluence-4578.html), if the software maintenance period included in your license has expired, you can keep using Confluence, but you'll need to renew before you can upgrade.

If we attempt a Confluence upgrade with an expired license, we can run into the issue outlined here:

* [Upgrading Beyond Current Licensed Period](https://confluence.atlassian.com/doc/upgrading-beyond-current-licensed-period-128286987.html)

There are some options to proceed and restore Confluence functionality.

1. Head to <https://my.atlassian.com> to renew your license or purchase a new license and follow the steps on [this guide](https://confluence.atlassian.com/doc/upgrading-beyond-current-licensed-period-128286987.html) to fix the license and restore access to Confluence.
2. Revert the upgrade by restoring Confluence to the previous version using the steps outlined [here](https://confluence.atlassian.com/doc/production-backup-strategy-38797389.html) and apply the CVE workaround immediately to keep Confluence safe.

We strongly recommend upgrading Confluence on a separate [staging environment](https://confluence.atlassian.com/doc/create-a-staging-environment-for-upgrading-confluence-866094180.html) first to validate the upgrade and ensure proper testing before upgrading production.


author: fidel dali
body: Thanks for the reply, I was able to update to 7.13 successfully.


author: Rob Horan
body: Forgive the basic question, but how does an attacker use this to gain access to the entire system? Assuming they are running on a Linux-based OS, wouldn't Confluence be running as a dedicated user, and not one with root-level privs?


Tags: confluence-server

cve-2022-26134

server