Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

An arbitrary file read vulnerability exists in the /s/ endpoint of Atlassian Confluence Server. An unauthenticated, remote attacker can abuse this vulnerability to view restricted resources

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.10 or 7.5.x prior to 7.12.3. It is, therefore, affected by a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
154244	Atlassian Confluence Server Arbitrary File Read (CVE-2021-26085)	Nessus	CGI abuses	medium
112966	Atlassian Confluence 7.5.x < 7.12.3 Arbitrary File Read	Web App Scanning	Component Vulnerability	medium
112965	Atlassian Confluence < 7.4.10 Arbitrary File Read	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2021-26085

medium

Tenable Plugins

medium

medium

medium