PT-2021-3899 · Atlassian · Confluence

Benny Jacob + 1 · Published 2021-07-27 · Updated 2026-03-10 · CVE-2021-26084

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server and Data Center versions prior to 6.13.23 Atlassian Confluence Server and Data Center versions 6.14.0 through 7.4.11 Atlassian Confluence Server and Data Center versions 7.5.0 through 7.11.6 Atlassian Confluence Server and Data Center versions 7.12.0 through 7.12.5

Description An Object-Graph Navigation Language (OGNL) injection issue exists in Atlassian Confluence Server and Data Center. This allows an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The vulnerability is related to improper handling of OGNL expressions. Exploitation has been observed in real-world attacks, including breaches of confluence.chronopay.com and cf.blackswordresearch.com, resulting in data leakage. The vulnerability is exploitable via the /pages/doenterpagevariables.action API endpoint, utilizing the queryString parameter. The vulnerability has been exploited by financially motivated actors and cryptominers. Approximately an unknown number of devices are potentially affected worldwide.

Recommendations Upgrade Confluence Server and Data Center to a version later than 6.13.23. Upgrade Confluence Server and Data Center to a version later than 7.4.11. Upgrade Confluence Server and Data Center to a version later than 7.11.6. Upgrade Confluence Server and Data Center to a version later than 7.12.5.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-917

Related Identifiers

BDU:2021-04333

BDU:2021-05399

CVE-2021-26084

Affected Products

Confluence

References · 147

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/atlassian_confluence_webwork_ognl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_webwork_ognl_injection.rb · Exploit
• 🔥 https://github.com/hev0x/CVE-2021-26084_Confluence · Exploit
• 🔥 https://github.com/h3v0x/CVE-2021-26084_Confluence · Exploit
• 🔥 https://github.com/Sma11New/PocList · Exploit
• 🔥 https://github.com/FanqXu/CVE-2021-26084 · Exploit
• 🔥 https://github.com/0xf4n9x/CVE-2021-26084 · Exploit
• 🔥 https://github.com/dinhbaouit/CVE-2021-26084 · Exploit
• 🔥 https://github.com/alt3kx/CVE-2021-26084_PoC · Exploit
• 🔥 https://github.com/1ZRR4H/CVE-2021-26084 · Exploit
• 🔥 https://github.com/carlosevieira/CVE-2021-26084 · Exploit
• 🔥 https://github.com/crowsec-edtech/CVE-2021-26084 · Exploit
• 🔥 https://github.com/Vulnmachines/Confluence_CVE-2021-26084 · Exploit
• 🔥 https://github.com/taythebot/CVE-2021-26084 · Exploit