Lucene search

[email protected]CVE-2021-39114

HistoryApr 05, 2022 - 4:15 a.m.

CVE-2021-39114

2022-04-0504:15:08

CWE-94

[email protected]

web.nvd.nist.gov

atlassian

confluence

data center

security

vulnerability

cve

2021

code execution

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.8%

JSON

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Affected configurations

NVD

Node

atlassianconfluence_data_centerRange<6.13.23

atlassianconfluence_data_centerRange6.14.0–7.4.11

atlassianconfluence_data_centerRange7.5.0–7.11.6

atlassianconfluence_data_centerRange7.12.0–7.12.5

atlassianconfluence_serverRange<6.13.23

atlassianconfluence_serverRange6.14.0–7.4.11

atlassianconfluence_serverRange7.5.0–7.11.6

atlassianconfluence_serverRange7.12.0–7.12.5

CPENameOperatorVersion
atlassian:confluence_data_centeratlassian confluence data centerlt6.13.23
atlassian:confluence_data_centeratlassian confluence data centerlt7.4.11
atlassian:confluence_data_centeratlassian confluence data centerlt7.11.6
atlassian:confluence_data_centeratlassian confluence data centerlt7.12.5
atlassian:confluence_serveratlassian confluence serverlt6.13.23
atlassian:confluence_serveratlassian confluence serverlt7.4.11
atlassian:confluence_serveratlassian confluence serverlt7.11.6
atlassian:confluence_serveratlassian confluence serverlt7.12.5

CPE	Name	Operator	Version
atlassian:confluence_data_center	atlassian confluence data center	lt	6.13.23
atlassian:confluence_data_center	atlassian confluence data center	lt	7.4.11
atlassian:confluence_data_center	atlassian confluence data center	lt	7.11.6
atlassian:confluence_data_center	atlassian confluence data center	lt	7.12.5
atlassian:confluence_server	atlassian confluence server	lt	6.13.23
atlassian:confluence_server	atlassian confluence server	lt	7.4.11
atlassian:confluence_server	atlassian confluence server	lt	7.11.6
atlassian:confluence_server	atlassian confluence server	lt	7.12.5

CNA Affected

[
  {
    "product": "Confluence Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "6.13.23",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.4.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.11.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.12.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.12.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Confluence Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "6.13.23",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.4.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.11.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.12.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.12.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/CONFSERVER-68844

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.8%

JSON

Related for CVE-2021-39114

prion1 cvelist1 nvd1 ubuntucve1 atlassian2