High severity · published May 21, 2024
CVE-2024-21683
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server
8.8
CVSS
88.3%
EPSS
No
On KEV
Description
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.
Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html
You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives.
This vulnerability was found internally.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)88.3% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Confluence · Atlassian
7.19.0 before 7.19.24; 7.20.0 through 7.20.3; 8.0.0 through 8.0.4; 8.1.0 through 8.1.4; 8.2.0 through 8.2.3; 8.3.0 through 8.3.4; +8 more · source: NVD
JI
Jira · Atlassian
9.4.0 before 9.4.21; 9.12.0 before 9.12.8 · source: NVD
CR
Crucible · Atlassian
4.8.0 before 4.8.15 · source: NVD
FI
Fisheye · Atlassian
4.8.0 before 4.8.15 · source: NVD
JD
Jira Data Center · Atlassian
9.4.0 before 9.4.21; 9.12.0 before 9.12.8 · source: NVD
JS
Jira Service Management · Atlassian
5.4.0 before 5.4.21; 5.12.0 before 5.12.8; 5.15.2 before 5.16.0; 5.4.0 before 5.4.21; 5.12.0 before 5.12.8; 5.15.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21683
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21683
Vendor Advisory
https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211
Issue Tracking
https://jira.atlassian.com/browse/CONFSERVER-95832
More from Confluence
9.8
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
9.8
CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
9.8
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
9.8
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
9.8
CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability