جزئیات آسیب‌پذیری
CVE-2024-21683
شرح رسمی (انگلیسی)
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.2بالا | 3.1 | CVEProject cvelistV5 (CNA) (atlassian) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Atlassian | Confluence Data Center | 7.19.0 to 7.19.21 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 7.19.22 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 7.20.0 to 7.20.3 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.0.0 to 8.0.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.1.0 to 8.1.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.2.0 to 8.2.3 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.3.0 to 8.3.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.4.0 to 8.4.5 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.5.0 to 8.5.8 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.5.9 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.6.0 to 8.6.2 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.7.1 to 8.7.2 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.8.0 to 8.8.1 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.9.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Confluence Data Center | 8.9.0 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.9.1 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 7.19.0 ≤ v ≤ 7.1921 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 7.20.0 ≤ v ≤ 7.20.3 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.0.0 ≤ v ≤ 8.0.4 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.1.0 ≤ v ≤ 8.1.4 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.2.0 ≤ v ≤ 8.2.3 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.3.0 ≤ v ≤ 8.3.4 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.4.0 ≤ v ≤ 8.4.5 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.5.0 ≤ v ≤ 8.5.8 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.6.0 ≤ v ≤ 8.6.2 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.7.1 ≤ v ≤ 8.7.2 | CISA ADP / Vulnrichment |
| Atlassian | Confluence Data Center | 8.8.0 ≤ v ≤ 8.8.1 | CISA ADP / Vulnrichment |
منابع و راهنماها
۲اطلاعات
- تاریخ انتشار
- ۱۴۰۳/۰۳/۰۲
- آخرین به‌روزرسانی
- ۱۴۰۴/۰۲/۲۲
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- atlassian
- اولویت کُلون
- ۴۶ · متوسط
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')