SB2023121277 - Atlassian Confluence Data Center and Server update for third-party software
Published: December 12, 2023 Updated: January 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) XML External Entity injection (CVE-ID: CVE-2020-25649)
The vulnerability allows a remote attacker to modify information on the system.
The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and modify information on the system.
2) Input validation error (CVE-ID: CVE-2022-28366)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of crafted Processing Instruction (PI) input. A remote attacker can trick the victim to visit a specially crafted web page and perform a denial of service (DoS) attack.
3) Input validation error (CVE-ID: CVE-2022-29546)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when parsing the Processing Instruction (PI) data. A remote attacker can trick the victim to open a specially crafted web page and perform a denial of service (DoS) attack.
4) Improper input validation (CVE-ID: CVE-2022-24839)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the Centralized Third Party Jars (NekoHTML) component in Oracle WebLogic Server. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
5) Resource exhaustion (CVE-ID: CVE-2023-44487)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".
Note, the vulnerability is being actively exploited in the wild.
6) Improper input validation (CVE-ID: CVE-2021-31684)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within indexOf() function of JSONParserByteArray. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
7) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2023-3635)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2023-5072)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to allocation of resources without limits or throttling. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.