PT-2024-2835 · Atlassian · Confluence

Published 2024-04-16 · Updated 2024-04-18 · CVE-2024-21676

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Confluence Data Center versions 7.3.0 through 8.5.7

Description The issue exists due to the failure to neutralize special elements used in operating system commands. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information by modifying system calls.

Recommendations For Confluence Data Center versions 7.3.0 through 8.5.7, upgrade to a release greater than or equal to 8.5.8. As a temporary workaround, consider restricting system call modifications until a patch is available.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2024-02983

CVE-2024-21676

Affected Products

Confluence

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-21676 · Security Note
• https://bdu.fstec.ru/vul/2024-02983 · Security Note
• https://twitter.com/CVEnew/status/1780283724807983414 · Twitter Post
• https://atlassian.com/software/confluence/download-archives · Note
• https://twitter.com/VulmonFeeds/status/1780311739000611150 · Twitter Post
• https://t.me/cvenotify/76948 · Telegram Post
• https://jira.atlassian.com/rest/api/2/issue/2005000 · Note