Atlassian · Confluence Server and Data Center
CVE-2021-26084
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Was es ist
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
CISA: Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
Was zu tun ist
Apply updates per vendor instructions.
Frist für US-Bundesbehörden: 17. November 2021
Weitere ausgenutzte Schwachstellen von Atlassian
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 03.11.2021 | Path Traversal | Confluence Server and Data Center | Hoch 8,8 | 97% |
| 15.10.2026 | Files or Directories Accessible to External Parties | Multiple Products | Kritisch 9,3 | 99,5% |
| 12.11.2024 | Path Traversal | Jira Server and Data Center | Mittel 5,3 | >99,9% |
| 24.01.2024 | Template Injection | Confluence Data Center and Server | Kritisch 10,0 | >99,9% |
| 07.11.2023 | Improper Authorization | Confluence Data Center and Server | Kritisch 10,0 | >99,9% |
| 05.10.2023 | Broken Access Control | Confluence Data Center and Server | Kritisch 10,0 | 99,2% |
| 30.09.2022 | Command Injection | Bitbucket Server and Data Center | Hoch 8,8 | 99,1% |
| 29.07.2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Kritisch 9,8 | 98% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.