PT-2024-2243 · Atlassian · Confluence+1

Published 2024-03-19 · Updated 2025-03-13 · CVE-2024-21677

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Confluence Data Center versions 6.13.0 through 8.8.0 Confluence Data Center versions 8.8.0 through 8.8.1 Confluence Server versions 8.5.0 through 8.5.6 Confluence Server versions 8.4.0 through 8.4.5 Confluence Server versions 8.3.0 through 8.3.4 Confluence Server versions 8.2.0 through 8.2.3 Confluence Server versions 8.1.0 through 8.1.4 Confluence Server versions 8.0.0 through 8.0.4 Confluence Server versions 7.20.0 through 7.20.3 Confluence Server versions 7.19.0 through 7.19.19 Confluence Server versions 7.18.0 through 7.18.3 Confluence Server versions 7.17.0 through 7.17.5 Confluence Server versions prior to 7.17.0

Description This Path Traversal vulnerability allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. The vulnerability was reported via the Bug Bounty program. It is estimated that over 684,000 services are affected, mainly distributed in the United States, China, and other countries.

Recommendations For Confluence Data Center version 6.13.0, upgrade to the latest version. For Confluence Data Center versions 8.8.0, upgrade to version 8.8.1. For Confluence Data Center versions 8.7.0 through 8.7.2, upgrade to version 8.8.1. For Confluence Data Center versions 8.6.0 through 8.6.2, upgrade to version 8.8.1. For Confluence Data Center versions 8.5.0 through 8.5.6, upgrade to version 8.8.1 or 8.5.7. For Confluence Data Center versions 8.4.0 through 8.4.5, upgrade to version 8.8.1 or 8.5.7. For Confluence Data Center versions 8.3.0 through 8.3.4, upgrade to version 8.8.1 or 8.5.7. For Confluence Data Center versions 8.2.0 through 8.2.3, upgrade to version 8.8.1 or 8.5.7. For Confluence Data Center versions 8.1.0 through 8.1.4, upgrade to version 8.8.1 or 8.5.7. For Confluence Data Center versions 8.0.0 through 8.0.4, upgrade to version 8.8.1 or 8.5.7. For Confluence Data Center versions 7.20.0 through 7.20.3, upgrade to version 8.8.1 or 8.5.7. For Confluence Data Center versions 7.19.0 through 7.19.19, upgrade to version 8.8.1 or 8.5.7 or 7.19.20. For Confluence Data Center versions 7.18.0 through 7.18.3, upgrade to version 8.8.1 or 8.5.7 or 7.19.20. For Confluence Data Center versions 7.17.0 through 7.17.5, upgrade to version 8.8.1 or 8.5.7 or 7.19.20. For Confluence Server version 8.5.0, upgrade to version 8.5.7. For Confluence Server versions 8.4.0 through 8.4.5, upgrade to version 8.5.7. For Confluence Server versions 8.3.0 through 8.3.4, upgrade to version 8.5.7. For Confluence Server versions 8.2.0 through 8.2.3, upgrade to version 8.5.7. For Confluence Server versions 8.1.0 through 8.1.4, upgrade to version 8.5.7. For Confluence Server versions 8.0.0 through 8.0.4, upgrade to version 8.5.7. For Confluence Server versions 7.20.0 through 7.20.3, upgrade to version 8.5.7. For Confluence Server versions 7.19.0 through 7.19.19, upgrade to version 8.5.7 or 7.19.20. For Confluence Server versions 7.18.0 through 7.18.3, upgrade to version 8.5.7 or 7.19.20. For Confluence Server versions 7.17.0 through 7.17.5, upgrade to version 8.5.7 or 7.19.20. As a temporary workaround, consider disabling the Confluence Cloud Migration Assistant plugin until a patch is available. Alternatively, upgrade the Confluence Cloud Migration Assistant plugin to version 3.9.5 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-02176

CVE-2024-21677

Affected Products

Confluence

Confluence Cloud Migration Assistant

References · 16

• https://confluence.atlassian.com/pages/viewpage.action?pageId=1369444862 · Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-94604 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21677 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21677 · Security Note
• https://bdu.fstec.ru/vul/2024-02176 · Security Note
• https://twitter.com/Netlas_io/status/1772194213221785708 · Twitter Post
• https://twitter.com/amirdaly0x00/status/1772174592444186647 · Twitter Post
• https://t.me/netlas/164 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1770160827410137121 · Twitter Post
• https://t.me/cvenotify/74279 · Telegram Post
• https://twitter.com/CVEnew/status/1770136751312437381 · Twitter Post
• https://twitter.com/zoomeye_team/status/1771117834770497907 · Twitter Post
• https://twitter.com/CZECHMATE_CZ/status/1772606315631677551 · Twitter Post
• https://twitter.com/HunterMapping/status/1770992162597171578 · Twitter Post