PT-2022-10885 · Atlassian · Confluence

Published 2022-04-05 · Updated 2024-10-07 · CVE-2021-39114

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server and Data Center versions prior to 6.13.23 Atlassian Confluence Server and Data Center versions 6.14.0 through 7.4.11 Atlassian Confluence Server and Data Center versions 7.5.0 through 7.11.6 Atlassian Confluence Server and Data Center versions 7.12.0 through 7.12.5

Description The issue allows users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload.

Recommendations For versions prior to 6.13.23, update to version 6.13.23 or later. For versions 6.14.0 through 7.4.11, update to version 7.4.11 or later. For versions 7.5.0 through 7.11.6, update to version 7.11.6 or later. For versions 7.12.0 through 7.12.5, update to version 7.12.5 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-39114

Affected Products

Confluence

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39114 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39114 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39114 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-39114 · Security Note
• https://ubuntu.com/security/CVE-2021-39114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39114 · Security Note
• https://t.me/cvenotify/97346 · Telegram Post
• https://jira.atlassian.com/browse/CONFSERVER-68844 · Note