Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.5 or 7.5.x < 7.5.1. It is, therefore, affected by an injection vulnerability in custom user macros allowing remote attackers with system administration permissions to bypass velocity template injection mitigations.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
112866	Atlassian Confluence 7.5.x < 7.5.1 Template Injection	Web App Scanning	Component Vulnerability	Version Based	medium
112865	Atlassian Confluence < 7.4.5 Template Injection	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2020-4027

medium

Tenable Plugins

medium

medium