Atlassian Confluence < 5.8.6 - Server-Side Request Forgery
Confluence Server and Data Center before 5.8.6 contain a blind server-side request forgery caused by the WidgetConnector plugin, letting remote attackers manipulate internal network resources, exploit requires network access to the server. References: https://bitbucket.org/atlassian/confluence-business-blueprints/pull-requests/144/issue-60-conf-45342-ssrf-in-sharelinks https://github.com/assetnote/blind-ssrf-chains#confluence https://nvd.nist.gov/vuln/detail/CVE-2021-26072 https://jira.atlassian.com/browse/CONFSERVER-61399
Used 3.4k times · url