Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Confluence_data_center | Atlassian | * | 7.4.10 (excluding) |
| Confluence_data_center | Atlassian | 7.5.0 (including) | 7.12.3 (excluding) |
| Confluence_server | Atlassian | * | 7.4.10 (excluding) |
| Confluence_server | Atlassian | 7.5.0 (including) | 7.12.3 (excluding) |