Atlassian · Confluence Server
CVE-2021-26085
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
무엇인가
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
CISA: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 4월 18일
Atlassian의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 10. 15. | Files or Directories Accessible to External Parties | Multiple Products | 치명적 9.3 | 99.5% |
| 2024. 11. 12. | Path Traversal | Jira Server and Data Center | 보통 5.3 | >99.9% |
| 2024. 1. 24. | Template Injection | Confluence Data Center and Server | 치명적 10.0 | >99.9% |
| 2023. 11. 7. | Improper Authorization | Confluence Data Center and Server | 치명적 10.0 | >99.9% |
| 2023. 10. 5. | Broken Access Control | Confluence Data Center and Server | 치명적 10.0 | 99.2% |
| 2022. 9. 30. | Command Injection | Bitbucket Server and Data Center | 높음 8.8 | 99.1% |
| 2022. 7. 29. | Questions For Confluence App Hard-coded Credentials | Confluence | 치명적 9.8 | 98% |
| 2022. 6. 2. | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | 치명적 9.8 | >99.9% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.