> And with tools like Confluence, there's a good chance that if you control the application, you can intercept login requests and steal credentials.
I thought Atlassian products were well trusted. Is that not the case?
I thought Atlassian products were well trusted. Is that not the case?
https://confluence.atlassian.com/doc/confluence-security-adv...
Each time, they patch the particular vulnerable script, but they don't seem to have done anything systematic which would eliminate the entire class of vulnerabilities (like, say, adding taint-checking for unquoted, client-supplied content before running code as an OGNL script). So they keep coming up.