Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Remediation

References

CVE-2021-26084

Related Vulnerabilities

Oracle JRE CVE-2023-22036 Vulnerability (CVE-2023-22036)

Oracle Database Server CVE-2007-2108 Vulnerability (CVE-2007-2108)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-2244)

WordPress Plugin Simple Flash Video Cross-Site Scripting (1.7)

PmWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2011-4453)

Severity

Critical

Classification

CVE-2021-26084 CWE-138 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities