Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.13.17, 7.14.0 prior to 7.19.9 or 7.20 prior to 8.2.2. It is, therefore, affected by a flaw which permits remote attackers with read only permissions to a page to upload attachments via a Broken Access Control vulnerability in the attachments feature.

ID	Name	Product	Family	Severity
113981	Atlassian Confluence 7.20.x < 8.2.2 Read Only User Attachment Uploads	Web App Scanning	Component Vulnerability	medium
113980	Atlassian Confluence 7.14.x < 7.19.9 Read Only User Attachment Uploads	Web App Scanning	Component Vulnerability	medium
113979	Atlassian Confluence < 7.13.17 Read Only User Attachment Uploads Service	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2023-22504

medium

Tenable Plugins

medium

medium

medium