Design/Logic Flaw

2022-04-0504:15:00

PRIOn knowledge base

www.prio-n.com

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.8%

JSON

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

CPENameOperatorVersion
confluence_data_centerge7.12.0
confluence_data_centerlt7.12.5
confluence_data_centerge7.5.0
confluence_data_centerlt7.11.6
confluence_data_centerge6.14.0
confluence_data_centerlt7.4.11
confluence_data_centerlt6.13.23
confluence_serverge7.12.0
confluence_serverlt7.12.5
confluence_serverge6.14.0

Name	Operator	Version
confluence_data_center	ge	7.12.0
confluence_data_center	lt	7.12.5
confluence_data_center	ge	7.5.0
confluence_data_center	lt	7.11.6
confluence_data_center	ge	6.14.0
confluence_data_center	lt	7.4.11
confluence_data_center	lt	6.13.23
confluence_server	ge	7.12.0
confluence_server	lt	7.12.5
confluence_server	ge	6.14.0