Problem

We were able to identify some security vulnerabilities in our User Profiles for Confluence app.

These are cross-site request forgery (XSRF) vulnerabilities which could be used to force an administrator to:

1. change the Company Chat App integration

2. enable or disable login synchronization

3. enable or disable Enhanced profile macro

4. purge data for deleted and deactivated users

5. change the Manager Configuration

6. edit User Profile Picture

The vulnerabilities have been rated as P3 (Medium) according to the scale published under the Bugcrowd’s Vulnerability Rating Taxonomy (VRT).

All user Profiles for Confluence versions until 3.3.10 are affected.

Solution

If you are using the User Profiles for Confluence app in one of the affected versions until 3.3.10, please immediately update to User Profiles for Confluence 3.3.11.

Root Cause

The vulnerabilities were caused due to the lack of a XSRF security token not being included in the requests mentioned above.