Confluence Security Advisory - 2019-03-20 question

[Jon Blackwell]

First, I am new here. 

Second, if the temporary workaround of disabling plugins suggested isn’t going to work for us because we need our users to be able to edit pages, what other choice do we have?

Is upgrading our one and only option? 

[Tarun Sapra]

Hello @Jon Blackwell 

If you can't disable the plugins then yes, upgrading is the only option available.

But you said

 isn’t going to work for us because we need our users to be able to edit pages, what other choice do we have?

Even after disabling the plugins, the users can keep using confluence and keep editing pages. Only issue is that they can't import doc files into confluence page as office connector is impacted.

[Tarun Sapra]

The advisory says

If you disable the WebDAV plugin, you will not be able to connect to Confluence using a WebDAV client. Disabling this plugin will also automatically disable the Office Connector plugin, which means Office Connector features such as Import from Word, and Edit in Office will not be available. Note that because WebDAV is not required to edit files from Confluence 6.11 and later

Hence normal page edit will work as usual only live edit of office files from within confluence will not work.

[Jon Blackwell]

I probably should have mentioned we are on version 5.7.3. 

[Tarun Sapra]

Hello @Jon Blackwell 

Yes, what I see in the advisory is you need to upgrade soon, but disabling the plugin is immediate mitigation of the problem and by disabling the plugin the edit page feature of the confluence should keep on working as I don't see it anywhere in the advisory that that disabling the plugin will stop the edit feature of confluence for your version of confluence.