Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team. The affected versions are before version 7.13.15, from version 7.14.0 before 7.19.7, and from version 7.20.0 before 8.2.0.
History

Tue, 01 Oct 2024 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: atlassian

Published: 2023-05-01T16:00:32.509Z

Updated: 2024-10-01T15:22:41.837Z

Reserved: 2023-01-01T00:01:22.329Z

Link: CVE-2023-22503

cve-icon Vulnrichment

Updated: 2024-08-02T10:13:48.665Z

cve-icon NVD

Status : Modified

Published: 2023-05-01T17:15:08.993

Modified: 2024-11-21T07:44:56.947

Link: CVE-2023-22503

cve-icon Redhat

No data.