Found the Bug while executed (VAPT) Vulnerability Assessment and Penetration Testing
Asked by Raj Prajapati:

Dear Team,

As we have deployed the License version for Confluence Application on Server premises

License ID - (SEN-20218955).

This is regards to found the bugs for VAPT scanning which we have deployed application on Windows server, hence we are looking out solutions as we found the bugs for confluence application.

Requesting you please have look and also assign some person which can contact us for further investigation and solutions.

|-------------------------------------------------------|---------------|---------------------|--------------------------------------|---------|
| Name                                                  | Risk Level    | Number of Instances | Details                              | Remarks |
| CSP: Wildcard Directive                               | Medium        | 44                  | Details are attached in VAPT Reports |         |
| Vulnerable JS Library                                 | Medium        | 19                  | Details are attached in VAPT Reports |         |
| Absence of Anti-CSRF Tokens                           | Low           | 38                  | Details are attached in VAPT Reports |         |
| Cookie No HttpOnly Flag                               | Low           | 23                  | Details are attached in VAPT Reports |         |
| Cookie Without SameSite Attribute                     | Low           | 25                  | Details are attached in VAPT Reports |         |
| Private IP Disclosure                                 | Low           | 40                  | Details are attached in VAPT Reports |         |
| X-Content-Type-Options Header Missing                 | Low           | 86                  | Details are attached in VAPT Reports |         |
| Information Disclosure - Sensitive Information in URL | Informational | 1                   | Details are attached in VAPT Reports |         |
| Information Disclosure - Suspicious Comments          | Informational | 118                 | Details are attached in VAPT Reports |         |
| Timestamp Disclosure - Unix                           | Informational | 326                 | Details are attached in VAPT Reports |         |

Please Note - There is no attachment options for VAPT Scanning details reports.

Many Thanks.

Raj Prajapati

Mob +91 9892668573


Answers:
author: Daniel Ebers
body: Hi Raj,

the prodecure as for security issues with Atlassian is as follows:

* If you discovered a new vulnerability please refer to the following page:  
  <https://www.atlassian.com/trust/security/report-a-vulnerability>
* In case the vulnerability is already known then please upgrade to the latest Confluence version (assuming it has the fix already):  
  <https://confluence.atlassian.com/doc/upgrading-confluence-4578.html>

Cheers,  
Daniel

comments: author: Raj Prajapati
body: Hi Daniel,

As per above issue we have also updated the above latest version but still VAPT scanning showing Vulnerability exist in the system.

Can i get valuable support to resolve that issue.

Thanks

Raj Prajapati


author: Daniel Ebers
body: Hi [@Raj Prajapati](/t5/user/viewprofilepage/user-id/3063327)

there is no support here - this is Community where users help users.  
This topic seems to me being full of more specific questions which you could direct to Atlassian Support - if an upgrade did not help.

<https://support.atlassian.com/contact>

Regards,  
Daniel


author: Raj Prajapati
body: Hi [@Daniel Ebers](/t5/user/viewprofilepage/user-id/800113)

Then how we can raise the bugs with Support Teams, as per security aspect thats are very major bugs which they have to resolve.

Please help us to raise the bugs to Support Teams.

Regards,

Raj


author: Daniel Ebers
body: I pasted in a link in the answer above - you fill out a form and get a reply.  
<https://support.atlassian.com/contact>


author: Raj Prajapati
body: I have gone through given url but again raising ticket to community groups only.

Can you please show us the way to raise the ticket through confluence developer?

I will be appreciated for your help.

Regards,

Raj


Tags: confluence-server

server