6 ms·
> And with tools like Confluence, there's a good chance that if you control the application, you can intercept login requests and steal credentials. I thought
by omegalulw 4y ago
> And with tools like Confluence, there's a good chance that if you control the application, you can intercept login requests and steal credentials.
I thought Atlassian products were well trusted. Is that not the case?
- rst 4y agoThey've had a string of script-injection vulnerabilities with similar severity -- the last was less than a year ago: https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html https://confluence.atlassian.com/doc/confluence-security-adv... Each time, they patch the particular vulnerable script, but they don't seem to have done anything systematic which would eliminate the entire class of vulnerabilities (like, say, adding taint-checking for unquoted, client-supplied content before running code as an OGNL script). So they keep coming up.
- acdha 4y agoThey’re widely used, which is not the same. If you’re a customer you’ll routinely encounter bugs, clumsy or inaccessible UI, annoying limitations, and performance issues which take ages to get fixed if ever. I would not assume that they’re better at security than everything else.