CVE-2021-39114

8.8HIGH

Key Information:

Vendor
Atlassian
Status
Confluence Server
Confluence Data Center
Vendor
CVE Published:
5 April 2022

Summary

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Affected Version(s)

Confluence Data Center < 6.13.23

Confluence Data Center 6.14.0

Confluence Data Center < 7.4.11

References

https://jira.atlassian.com/browse/CONFSERVER-68844
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.