Critical severity · published Aug 30, 2021
CVE-2021-26084
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
RansomwareIn wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueNov 17, 2021
Ransomware campaign useKnown
Affected products
Which versions
CO
Confluence · Atlassian
before 6.13.23; 6.14.0 before unspecified; before 7.4.11; 7.5.0 before unspecified; before 7.11.6; 7.12.0 before unspecified; +1 more · source: vendor, NVD
CS
Confluence Server and Data Center · Atlassian
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26084
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://jira.atlassian.com/browse/CONFSERVER-67940
x_refsource_MISC
http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
More from Confluence
9.8
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
9.8
CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
9.8
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
9.8
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
9.8
CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability