Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-68844

RCE on Confluence Data Center via OGNL Injection - CVE-2021-39114

XMLWordPrintable

    • 8.8
    • High
    • CVE-2021-39114

      A user with a valid account on a Confluence Server or Data Center instance is able to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload.

       

      The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

      Affected versions:

       * version < 6.13.23
       * 6.14.0 ≤ version < 7.4.11
       * 7.5.0 ≤ version < 7.11.6
       * 7.12.0 ≤ version < 7.12.5

      Fixed versions:

       * 6.13.23
       * 7.4.11
       * 7.11.6
       * 7.12.5
       * 7.13.0

            [CONFSERVER-68844] RCE on Confluence Data Center via OGNL Injection - CVE-2021-39114

            Cathy S made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 647675 ]
            David Black made changes -
            Link New: This issue relates to CONFSERVER-67940 [ CONFSERVER-67940 ]
            Cathy S made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 628990 ]
            Security Metrics Bot made changes -
            CVE ID New: CVE-2021-39114
            Jamal Hopwood 🐙 made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Draft [ 12872 ] New: Published [ 12873 ]
            Jamal Hopwood 🐙 made changes -
            Security Original: Atlassian Staff [ 10750 ]
            Jamal Hopwood 🐙 made changes -
            Labels Original: advisory advisory-to-release dont-import security New: advisory advisory-released dont-import security
            Jamal Hopwood 🐙 made changes -
            Assignee New: Jamal Hopwood 🐙 [ 8720c7add7cc ]
            Jamal Hopwood 🐙 made changes -
            Summary Original: RCE on Confluence Data Center via OGNL Injection New: RCE on Confluence Data Center via OGNL Injection - CVE-2021-39114
            Jamal Hopwood 🐙 made changes -
            Description Original: A user with a valid account on a Confluence Server or Data Center instance is able to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload.

             

            Affected versions:
             * Before version 6.13.23

             

            ;version             		New: A user with a valid account on a Confluence Server or Data Center instance is able to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload.

             

            The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

            *Affected versions:*

             * version < 6.13.23
             * 6.14.0 ≤ version < 7.4.11
             * 7.5.0 ≤ version < 7.11.6
             * 7.12.0 ≤ version < 7.12.5

            *Fixed versions:*

             * 6.13.23
             * 7.4.11
             * 7.11.6
             * 7.12.5
             * 7.13.0

              8720c7add7cc Jamal Hopwood 🐙
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: