Server-Side Request Forgery Vulnerability in Confluence by Atlassian
CVE-2021-26072
4.3MEDIUM
Key Information:
- Vendor
- Atlassian
- Vendor
- CVE Published:
- 1 April 2021
Summary
The WidgetConnector plugin in Confluence Server and Confluence Data Center versions before 5.8.6 is vulnerable to a blind Server-Side Request Forgery (SSRF). This vulnerability enables remote attackers to exploit the system by manipulating internal network resource requests, potentially leading to unauthorized access and data exposure.
Affected Version(s)
Confluence Data Center < 5.8.6
Confluence Server < 5.8.6
References
EPSS Score
8% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved