CVE-2018-20237 Information disclosure in Confluence Data Center
Authenticated users can download deleted pages via the word export feature, exposing potentially sensitive content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-20237?
CVE-2018-20237 is a medium-severity vulnerability in Atlassian Confluence Data Center, published on 13 Feb 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature.
Weakness: CWE-668
Which versions are affected by CVE-2018-20237?
It affects 2 products.
Products include Atlassian Confluence Data Center, Atlassian Confluence Server.
How do I fix CVE-2018-20237?
No fix has been published for CVE-2018-20237 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-20237 being exploited?
There is no known exploitation of CVE-2018-20237 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Confluence Data Center
- CVE-2023-22527 Atlassian Confluence Data Center and Server Template Injection
- CVE-2023-22518 Atlassian Confluence Data Center and Server Improper Authorization
- CVE-2023-22515 Atlassian Confluence Data Center and Server Broken Access Control
- CVE-2022-26134 Atlassian Confluence Server and Data Center Remote Code Execution
- CVE-2021-26084 Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection
Sources
Also known as GHSA-6cff-mj8v-fvr9.