Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Remediation

References

CVE-2021-26084

Related Vulnerabilities

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4791)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-2168)

Jenkins Improper Input Validation Vulnerability (CVE-2017-1000401)

WordPress Plugin WP RSS Multi Importer Multiple Vulnerabilities (3.15)

WordPress Plugin GdeSlon Affiliate Shop Open Redirect (2.0)

Severity

Critical

Classification

CVE-2021-26084 CWE-138 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities