- Affected Products: Confluence
- Severity: High
- Published Date: 10/15/2024
- Severity Score: 7.5
- CVE ID: CVE-2022-31129
- CVE ID Link: https://nvd.nist.gov/vuln/detail/CVE-2022-31129
- Atlassian Link: https://jira.atlassian.com/browse/CONFSERVER-98189
This High severity ReDoS vulnerability was introduced in version 7.19.0 of Confluence Data Center and Server.
This ReDoS vulnerability, with a CVSS Score of 7.5, allows an unauthenticated attacker to provide a crafted input string to disrupt service availability, which has no impact to confidentiality, no impact to integrity, high impact to availability, and requires no user interaction.
Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
| Affected Versions | Fixed Versions |
|---|---|
| from 7.19.0 to 7.19.25 LTS | 7.19.26 or 8.0.0 |
See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives).
This vulnerability was reported via our Bug Bounty program.
Â
This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.
Description
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
Â