Log in / Sign up

Vulnerability details

CVE-2024-21683

Atlassian Confluence Data Center
CVSS 3.1
7.2High

Official description

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.

CVSS scores

ScoreVersionSourceVector
7.2High 3.1 CVEProject cvelistV5 (CNA) (atlassian) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
Atlassian Confluence Data Center 7.19.0 to 7.19.21 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 7.19.22 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 7.20.0 to 7.20.3 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.0.0 to 8.0.4 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.1.0 to 8.1.4 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.2.0 to 8.2.3 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.3.0 to 8.3.4 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.4.0 to 8.4.5 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.5.0 to 8.5.8 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.5.9 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.6.0 to 8.6.2 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.7.1 to 8.7.2 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.8.0 to 8.8.1 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.9.0 CVEProject cvelistV5 (CNA)
Atlassian Confluence Data Center 8.9.0 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.9.1 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 7.19.0 ≤ v ≤ 7.1921 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 7.20.0 ≤ v ≤ 7.20.3 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.0.0 ≤ v ≤ 8.0.4 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.1.0 ≤ v ≤ 8.1.4 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.2.0 ≤ v ≤ 8.2.3 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.3.0 ≤ v ≤ 8.3.4 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.4.0 ≤ v ≤ 8.4.5 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.5.0 ≤ v ≤ 8.5.8 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.6.0 ≤ v ≤ 8.6.2 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.7.1 ≤ v ≤ 8.7.2 CISA ADP / Vulnrichment
Atlassian Confluence Data Center 8.8.0 ≤ v ≤ 8.8.1 CISA ADP / Vulnrichment

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2024-05-22
Last updated
2025-05-12
State
Published
Assigner (CNA)
atlassian
Kolun priority
46 · Medium

Exploit prediction (EPSS)

88.26%
Probability of exploitation in 30 days
99.7%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Total

Weaknesses (CWE)

  • CWE-94
    Improper Control of Generation of Code ('Code Injection')