Confluence, Java on Tomcat

Its Layers

Confluence is a Java application that runs on Tomcat. A flaw in Confluence or Tomcat runs with the service account's rights.

The stack runs from the top layer down, as on the topic page. Each layer shows its technology, and the badge beside it says who runs and patches it.

Who Runs What

You run every layer, from Confluence and the Tomcat it ships with to Java, PostgreSQL and Linux. Atlassian's cloud version moves all of that to Atlassian, and the self-managed edition reaches end of life on 28 March 2029.

You

Your team runs it and installs its updates.

Where Its Code Comes From

Atlassian's updates bring Confluence with its Tomcat and hundreds of Java libraries inside, many of them from Maven Central. The server beneath it gets its software from the Linux distribution's packages.

• Vendor Updates
• Maven Central
• OS Packages

Well-Known Flaws in Its Layers

These are well-known flaws in the technologies this stack is built from. Each CVE id links to its advisory, and the technology's own page says how far that flaw reached.

• CVE-2022-26134 (opens in a new tab)2022

  OGNL Injection, in Confluence

  An unauthenticated attacker could inject OGNL expressions and run code.

• CVE-2020-1938 (opens in a new tab)2020

  Ghostcat, in Tomcat

  An exposed AJP connector let attackers read files and sometimes run code.

• CVE-2016-5195 (opens in a new tab)2016

  Dirty COW, in Linux

  A race condition in the Linux kernel let a local user gain root.

Sources

• Atlassian: end of life for the self-managed edition (opens in a new tab)