Atlassian · Confluence Server and Data Center
CVE-2021-26084
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Nedir
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
CISA: Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 17 Kasım 2021
Atlassian için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 3 Kas 2021 | Path Traversal | Confluence Server and Data Center | Yüksek 8,8 | 97% |
| 15 Eki 2026 | Files or Directories Accessible to External Parties | Multiple Products | Kritik 9,3 | 99,5% |
| 12 Kas 2024 | Path Traversal | Jira Server and Data Center | Orta 5,3 | >99,9% |
| 24 Oca 2024 | Template Injection | Confluence Data Center and Server | Kritik 10,0 | >99,9% |
| 7 Kas 2023 | Improper Authorization | Confluence Data Center and Server | Kritik 10,0 | >99,9% |
| 5 Eki 2023 | Broken Access Control | Confluence Data Center and Server | Kritik 10,0 | 99,2% |
| 30 Eyl 2022 | Command Injection | Bitbucket Server and Data Center | Yüksek 8,8 | 99,1% |
| 29 Tem 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Kritik 9,8 | 98% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.