Skip to main content
Skip table of contents

2024-03-25 - Security improvement

A security issue was fixed on March, 25th 2024.

Nature of the issue

A security vulnerability was recently identified in Elements Spreadsheet.

Impact

Based on our investigations, the vulnerability meant that an active user could post comments in Spreadsheet documents on behalf of someone else, by using the Confluence REST API.

This flaw could have enabled a malicious user to forge comments using the identity of other users. Such actions can be used to tarnish someone's reputation or benefit the forger.

To exploit this vulnerability, this user needed to have access to the page where the Spreadsheet document was located, and the process could not be done directly through the Confluence interface, only through an API call. 
Thus, the vulnerability required access and skills, which limited its availability. 
We have no evidence that this was done even once by actual users.

Analysis and actions taken

Once we became aware of the issue, we reproduced it and identified the origin of the problem.

Since the primary concern of the vulnerability revolved around the fact that a user could impersonate another user, so we decided to completely remove the author from comments. This means comments will no longer be identified by their author and will be repurposed as sticky notes. Note that it's still possible to add user mentions inside a comment. 


Comments look and feel without the comment author

Conclusion

We want you to know that we take security issues very seriously. We are taking measures to make sure this does not occur again for any of our customers.

If you have any questions, please feel free to raise a support request at support.elements-apps.com.


JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.