Vulnerability Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Confluence Data Center | < 6.13.23 |
| Atlassian | Confluence Server | < 6.13.23 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-ExploitThird Party AdvisoryVDB Entry
- https://jira.atlassian.com/browse/CONFSERVER-67940Issue TrackingPatchVendor Advisory
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-ExploitThird Party AdvisoryVDB Entry
- https://jira.atlassian.com/browse/CONFSERVER-67940Issue TrackingPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-US Government Resource
FAQ
What is CVE-2021-26084?
CVE-2021-26084 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data ...
How severe is CVE-2021-26084?
CVE-2021-26084 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-26084?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Confluence Data Center, Atlassian Confluence Server.