CVE-2021-39114
8.8HIGH
Key Information
- Vendor
- Atlassian
- Status
- Confluence Server
- Confluence Data Center
- Vendor
- CVE Published:
- 5 April 2022
Summary
Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Affected Version(s)
Confluence Server < 6.13.23
Confluence Server < 6.14.0
Confluence Server < 7.4.11
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published.
Vulnerability Reserved.
Collectors
NVD DatabaseMitre Database