Confluence 6.6 (LTS)
Confluence 6.6 (LTS)
The Confluence 6.6 (LTS) reached end of service life on Dec 12, 2019 — Confluence no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Confluence 6.6 (LTS) incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- confluence
- release
- 6.6
- product Label
- Confluence
- release Label
- 6.6 (LTS)
- codename
- lts
- true
- latest Version
- 6.6.17
- release Date
- 2017-12-10
- maintained
- source Url
- https://endoflife.date/confluence
Lifecycle Dates
- End of Service Life
- Dec 12, 2019
- Last OEM Support
- Dec 12, 2019
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Confluence 6.6 (LTS) — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Confluence 6.6 (LTS)?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Confluence 6.6 (LTS) when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Confluence 6.6 (LTS) Support: Frequently Asked Questions
Is the Confluence 6.6 (LTS) still supported?
Confluence ended support for the Confluence 6.6 (LTS) on Dec 12, 2019 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Confluence 6.6 (LTS) end of service life (EOSL) date?
Confluence lists the end of service life for the Confluence 6.6 (LTS) as Dec 12, 2019.
Can I keep using the Confluence 6.6 (LTS) after its EOSL date?
Yes. EOSL means Confluence stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Confluence 6.6 (LTS) cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Confluence 6.6 (LTS)
7 published CVEs affect the Confluence 6.6 (LTS), including 3 rated critical or high severity. Confluence no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2019-3395 | CRITICAL | 9.8 | Mar 25, 2019 | The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery. |
| CVE-2019-3394 | HIGH | 8.8 | Aug 29, 2019 | There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under <install-directory>/confluence/WEB-INF directory, which may contain configuration files used for integrating with other services, which could potentially leak credentials or other sensitive information such as LDAP credentials. The LDAP credential will be potential |
| CVE-2019-20406 | HIGH | 7.8 | Feb 6, 2020 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability. |
| CVE-2017-18085 | MEDIUM | 6.1 | Feb 2, 2018 | The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the key parameter. |
| CVE-2020-4027 | MEDIUM | 4.7 | Jul 1, 2020 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1. |
| CVE-2018-13389 | MEDIUM | 4.7 | Jul 10, 2018 | The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of application/rdf+xml. |
| CVE-2019-15005 | MEDIUM | 4.3 | Nov 8, 2019 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / |