CVE-2021-26084

Scores

EPSS Score

0.9444

CVSS

3.x 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All CVSS Scores

CVSS 4.0

0.0

CVSS 3.x

9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0

7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Sources

nvd

CWEs

CWE-917

Related Vulnerabilities

BDU:2021-04333 BDU:2021-05399

Exploits

Exploit ID: CVE-2021-26084

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit ID: 50243

Source: exploitdb

URL: https://www.exploit-db.com/exploits/50243

Reference Links

http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html

https://jira.atlassian.com/browse/CONFSERVER-67940

Vulnerable Software

Type: Configuration

Vendor: atlassian

Product: confluence_data_center

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "6.13.23",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.4.11",
      "versionStartIncluding": "6.14.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.11.6",
      "versionStartIncluding": "7.5.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.12.5",
      "versionStartIncluding": "7.12.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "6.13.23",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.4.11",
      "versionStartIncluding": "6.14.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.11.6",
      "versionStartIncluding": "7.5.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.12.5",
      "versionStartIncluding": "7.12.0",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: atlassian

Product: confluence_server

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "6.13.23",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.4.11",
      "versionStartIncluding": "6.14.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.11.6",
      "versionStartIncluding": "7.5.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.12.5",
      "versionStartIncluding": "7.12.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "6.13.23",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.4.11",
      "versionStartIncluding": "6.14.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.11.6",
      "versionStartIncluding": "7.5.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.12.5",
      "versionStartIncluding": "7.12.0",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd