CVE-2021-43940

7.8HIGH

Key Information:

Vendor
Atlassian
Status
Confluence Server
Confluence Data Center
Vendor
CVE Published:
15 February 2022

Summary

Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

Affected Version(s)

Confluence Data Center < 7.4.10

Confluence Data Center 7.5.0

Confluence Data Center < 7.12.3

References

https://jira.atlassian.com/browse/CONFSERVER-66550
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.