by Kastro
Paper/Archive/CVE-2021-26084

CVE-2021-26084

Atlassian Confluence Server — Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

KEV · due 17 Novransomware useEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Affected

ProductAffectedFixed inSource
Confluence Serverunspecified – < 6.13.236.13.23CNA
Confluence Server6.14.0 – < unspecifiedunspecifiedCNA
Confluence Serverunspecified – < 7.4.117.4.11CNA
Confluence Server7.5.0 – < unspecifiedunspecifiedCNA
Confluence Serverunspecified – < 7.11.67.11.6CNA
Confluence Server7.12.0 – < unspecifiedunspecifiedCNA
Confluence Serverunspecified – < 7.12.57.12.5CNA
Confluence Data Centerunspecified – < 6.13.236.13.23CNA
Confluence Data Center6.14.0 – < unspecifiedunspecifiedCNA
Confluence Data Centerunspecified – < 7.4.117.4.11CNA
Confluence Data Center7.5.0 – < unspecifiedunspecifiedCNA
Confluence Data Centerunspecified – < 7.11.67.11.6CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refjira.atlassian.com/browse/CONFSERVER-67940refpacketstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26084kevcisa.gov/known-exploited-vulnerabilities-catalog