Confluence 6.13 (LTS)
Confluence 6.13 (LTS)
The Confluence 6.13 (LTS) reached end of service life on Dec 4, 2020 — Confluence no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Confluence 6.13 (LTS) incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- confluence
- release
- 6.13
- product Label
- Confluence
- release Label
- 6.13 (LTS)
- codename
- lts
- true
- latest Version
- 6.13.23
- release Date
- 2018-12-02
- maintained
- source Url
- https://endoflife.date/confluence
Lifecycle Dates
- End of Service Life
- Dec 4, 2020
- Last OEM Support
- Dec 4, 2020
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Confluence 6.13 (LTS) — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Confluence 6.13 (LTS)?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Confluence 6.13 (LTS) when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Confluence 6.13 (LTS) Support: Frequently Asked Questions
Is the Confluence 6.13 (LTS) still supported?
Confluence ended support for the Confluence 6.13 (LTS) on Dec 4, 2020 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Confluence 6.13 (LTS) end of service life (EOSL) date?
Confluence lists the end of service life for the Confluence 6.13 (LTS) as Dec 4, 2020.
Can I keep using the Confluence 6.13 (LTS) after its EOSL date?
Yes. EOSL means Confluence stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Confluence 6.13 (LTS) cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Confluence 6.13 (LTS)
5 published CVEs affect the Confluence 6.13 (LTS), including 2 rated critical or high severity. Confluence no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2019-3394 | HIGH | 8.8 | Aug 29, 2019 | There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under <install-directory>/confluence/WEB-INF directory, which may contain configuration files used for integrating with other services, which could potentially leak credentials or other sensitive information such as LDAP credentials. The LDAP credential will be potential |
| CVE-2019-20406 | HIGH | 7.8 | Feb 6, 2020 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability. |
| CVE-2019-15006 | MEDIUM | 6.5 | Dec 19, 2019 | There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additionally, a signed c |
| CVE-2020-4027 | MEDIUM | 4.7 | Jul 1, 2020 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1. |
| CVE-2019-15005 | MEDIUM | 4.3 | Nov 8, 2019 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / |