Ming

The issue concerns a deserialization of untrusted data, allowing for an arbitrary file read vulnerability. This can be exploited by bypassing security measures through double writing of a parameter.

The issue allows an authenticated attacker to inject malicious data into the task instance logs. This is a critical security vulnerability that enables attackers to inject data into the task instance logs.

The issue is related to the deserialization of untrusted data, allowing attackers to bypass security using malicious parameters.

A local file disclosure issue exists via page exporting, allowing an attacker with page editing permission to read arbitrary files on the server under the <install-directory>/confluence/WEB-INF directory. This may lead to the leakage of sensitive information, including configuration files for integrating with other services and potentially LDAP credentials if the Confluence server is configured to use LDAP as a user repository.