Ming

تتعلق المشكلة بإلغاء تسلسل البيانات غير الموثوقة، مما يتيح ثغرة أمنية تسمح بقراءة الملفات بشكل تعسفي. ويمكن استغلال هذه الثغرة من خلال التحايل على الإجراءات الأمنية عن طريق الكتابة المزدوجة لمعلمة ما.

The issue allows an authenticated attacker to inject malicious data into the task instance logs. This is a critical security vulnerability that enables attackers to inject data into the task instance logs.

The issue is related to the deserialization of untrusted data, allowing attackers to bypass security using malicious parameters.

A local file disclosure issue exists via page exporting, allowing an attacker with page editing permission to read arbitrary files on the server under the <install-directory>/confluence/WEB-INF directory. This may lead to the leakage of sensitive information, including configuration files for integrating with other services and potentially LDAP credentials if the Confluence server is configured to use LDAP as a user repository.