PT-2022-11940 · Microsoft+1 · Windows+1

Published 2022-02-15 · Updated 2024-10-08 · CVE-2021-43940

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server and Data Center versions prior to 7.4.10 Atlassian Confluence Server and Data Center versions 7.5.0 through 7.12.3

Description The issue allows authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows.

Recommendations For versions prior to 7.4.10, update to version 7.4.10 or later. For versions 7.5.0 through 7.12.3, update to version 7.12.3 or later.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2021-43940

Affected Products

Confluence

Windows

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-43940 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43940 · Security Note
• https://jira.atlassian.com/browse/CONFSERVER-66550 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43940 · Vendor Advisory
• https://t.me/cibsecurity/37473 · Telegram Post