Log in Start free

Vulnerability · Published Apr 5, 2022 · Assigned by atlassian

CVE-2021-39114

High 8.8

In plain English

A high-severity code injection in Confluence Data Center from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.7%top 22.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Affected products (as reported)

VendorProductVersions
Atlassian Confluence Server unspecified – before 6.13.236.14.0 – before unspecifiedunspecified – before 7.4.117.5.0 – before unspecifiedunspecified – before 7.11.67.12.0 – before unspecifiedunspecified – before 7.12.5
Atlassian Confluence Data Center unspecified – before 6.13.236.14.0 – before unspecifiedunspecified – before 7.4.117.5.0 – before unspecifiedunspecified – before 7.11.67.12.0 – before unspecifiedunspecified – before 7.12.5

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References