CVEvulnerability

CVE-2021-39114

8.8 HIGH Published 2022-04-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-04-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-94

Description

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Affected configurations

• atlassian confluence data center (< 6.13.23) • atlassian confluence data center (>= 6.14.0 < 7.4.11) • atlassian confluence data center (>= 7.5.0 < 7.11.6) • atlassian confluence data center (>= 7.12.0 < 7.12.5) • atlassian confluence server (< 6.13.23) • atlassian confluence server (>= 6.14.0 < 7.4.11) • atlassian confluence server (>= 7.5.0 < 7.11.6) • atlassian confluence server (>= 7.12.0 < 7.12.5)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References