description: Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature.
problem types: Improper Authorization
affected:
{
vendor: Atlassian
product: Confluence Data Center
versions:
version: < 1.1.2, status: unaffected
version: >= 1.1.2, status: affected
version: >= 7.14.0, status: affected
version: >= 7.20.0, status: affected
version: >= 7.13.7, status: unaffected
version: >= 7.19.9, status: unaffected
version: >= 8.2.2, status: unaffected
version: >= 8.3.0, status: unaffected
}
{
vendor: Atlassian
product: Confluence Server
versions:
version: < 1.1.2, status: unaffected
version: >= 1.1.2, status: affected
version: >= 7.14.0, status: affected
version: >= 7.20.0, status: affected
version: >= 7.13.7, status: unaffected
version: >= 7.19.9, status: unaffected
version: >= 8.2.2, status: unaffected
version: >= 8.3.0, status: unaffected
}
metrics:
cvssV3_0: [
version: 3.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
]