Confluence

Atlassian's team wiki and documentation platform.

Application
Atlassian

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

AppConfluence
Framework
Web Server
Runtime
Containers
OS
Hypervisor
Firmware
Hardware
Data

Application

Runs On

Keeps Data In

PostgreSQLData

See It in the Stack

About

Confluence is a wiki where teams keep documentation. It is a Java application that runs inside Tomcat, storing its pages in a relational database such as PostgreSQL. Atlassian now sells it as a cloud service, and the self-managed version reaches end of life in 2029.

How to Spot It

These are signs that a system runs Confluence, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Path: /login.action
Response header: X-Confluence-Request-Time: 1700000000000
Cookie: JSESSIONID

If It Has a Flaw

Confluence runs as a service account on the server, so a flaw in it can reach every page and, through that account, the host.

A flaw exposes the data it keeps.

Data: PostgreSQL

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Confluence sits.

CVE-2022-26134 (opens in a new tab)2022
OGNL Injection
An unauthenticated attacker could inject OGNL expressions and run code.
Reach It ran as the Confluence service account, exposing every page and the host.

Stacks and Code

Confluence is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.