PT-2024-1778 · Atlassian · Confluence

Published 2024-02-20 · Updated 2025-05-06 · CVE-2024-21678

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Confluence Data Center versions 2.7.0 through 8.7.1 Confluence Data Center versions 8.6.0 through 8.6.1 Confluence Data Center versions 8.5.0 through 8.5.4 LTS Confluence Data Center versions 8.4.0 through 8.4.5 Confluence Data Center versions 8.3.0 through 8.3.4 Confluence Data Center versions 8.2.0 through 8.2.3 Confluence Data Center versions 8.1.0 through 8.1.4 Confluence Data Center versions 8.0.0 through 8.0.4 Confluence Data Center versions 7.20.0 through 7.20.3 Confluence Data Center versions 7.19.0 through 7.19.17 LTS Confluence Data Center versions 7.18.0 through 7.18.3 Confluence Data Center versions 7.17.0 through 7.17.5 Confluence Data Center versions prior to 7.17.0 Confluence Server versions 8.5.0 through 8.5.4 LTS Confluence Server versions 8.4.0 through 8.4.5 Confluence Server versions 8.3.0 through 8.3.4 Confluence Server versions 8.2.0 through 8.2.3 Confluence Server versions 8.1.0 through 8.1.4 Confluence Server versions 8.0.0 through 8.0.4 Confluence Server versions 7.20.0 through 7.20.3 Confluence Server versions 7.19.0 through 7.19.17 LTS Confluence Server versions 7.18.0 through 7.18.3 Confluence Server versions 7.17.0 through 7.17.5 Confluence Server versions prior to 7.17.0

Description This Stored XSS vulnerability allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser, which has high impact to confidentiality, low impact to integrity, and no impact to availability, and requires no user interaction.

Recommendations For Confluence Data Center versions 8.7.0 through 8.7.1, upgrade to version 8.8.0 or 8.7.2. For Confluence Data Center versions 8.6.0 through 8.6.1, upgrade to version 8.8.0. For Confluence Data Center versions 8.5.0 through 8.5.4 LTS, upgrade to version 8.8.0, 8.5.5 LTS, or 8.5.6 LTS. For Confluence Data Center versions 8.4.0 through 8.4.5, upgrade to version 8.8.0 or 8.5.6 LTS. For Confluence Data Center versions 8.3.0 through 8.3.4, upgrade to version 8.8.0 or 8.5.6 LTS. For Confluence Data Center versions 8.2.0 through 8.2.3, upgrade to version 8.8.0 or 8.5.6 LTS. For Confluence Data Center versions 8.1.0 through 8.1.4, upgrade to version 8.8.0 or 8.5.6 LTS. For Confluence Data Center versions 8.0.0 through 8.0.4, upgrade to version 8.8.0 or 8.5.6 LTS. For Confluence Data Center versions 7.20.0 through 7.20.3, upgrade to version 8.8.0 or 8.5.6 LTS. For Confluence Data Center versions 7.19.0 through 7.19.17 LTS, upgrade to version 8.8.0, 8.5.6 LTS, 7.19.18 LTS, or 7.19.19 LTS. For Confluence Data Center versions 7.18.0 through 7.18.3, upgrade to version 8.8.0, 8.5.6 LTS, or 7.19.19 LTS. For Confluence Data Center versions 7.17.0 through 7.17.5, upgrade to version 8.8.0, 8.5.6 LTS, or 7.19.19 LTS. For Confluence Data Center versions prior to 7.17.0, upgrade to version 8.8.0, 8.5.6 LTS, or 7.19.19 LTS. For Confluence Server versions 8.5.0 through 8.5.4 LTS, upgrade to version 8.5.5 LTS or 8.5.6 LTS. For Confluence Server versions 8.4.0 through 8.4.5, upgrade to version 8.5.6 LTS. For Confluence Server versions 8.3.0 through 8.3.4, upgrade to version 8.5.6 LTS. For Confluence Server versions 8.2.0 through 8.2.3, upgrade to version 8.5.6 LTS. For Confluence Server versions 8.1.0 through 8.1.4, upgrade to version 8.5.6 LTS. For Confluence Server versions 8.0.0 through 8.0.4, upgrade to version 8.5.6 LTS. For Confluence Server versions 7.20.0 through 7.20.3, upgrade to version 8.5.6 LTS. For Confluence Server versions 7.19.0 through 7.19.17 LTS, upgrade to version 8.5.6 LTS, 7.19.18 LTS, or 7.19.19 LTS. For Confluence Server versions 7.18.0 through 7.18.3, upgrade to version 8.5.6 LTS or 7.19.19 LTS. For Confluence Server versions 7.17.0 through 7.17.5, upgrade to version 8.5.6 LTS or 7.19.19 LTS. For Confluence Server versions prior to 7.17.0, upgrade to version 8.5.6 LTS or 7.19.19 LTS.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-01509

CVE-2024-21678

Affected Products

Confluence

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2024-21678 · Security Note
• https://jira.atlassian.com/browse/CONFSERVER-94513 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21678 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01509 · Security Note
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21678 · Security Note
• https://t.me/cvenotify/100175 · Telegram Post
• https://twitter.com/CVEnew/status/1760006567456583733 · Twitter Post
• https://twitter.com/fridaysecurity/status/1760249787390079239 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1760248423092207616 · Twitter Post
• https://vuldb.com/ja/?id.254244 · Note
• https://confluence.atlassian.com/security/security-bulletin-february-20-2024-1354501606.html · Note
• https://twitter.com/fletch_ai/status/1760501414923575601 · Twitter Post
• https://twitter.com/Dinosn/status/1760899740441461121 · Twitter Post
• https://t.me/cvenotify/120989 · Telegram Post