Recently disclosed critical flaw in Atlassian Confluence Server is being exploited in the wild by attackers. Organizations should apply patches immediately. Background On August 25, Atlassian published a security advisory for a critical vulnerability in its Confluence Server and Data Center software.

CVE-2021-26084: Atlassian Confluence OGNL Injection Vulnerability Exploited in the Wild

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.23, 6.14.x prior to 7.4.11, 7.5.x prior to 7.11.6 or 7.12.x prior to 7.12.5. It is, therefore, affected by an OGNL injection vulnerability that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Atlassian Confluence application running on the remote host is affected by an OGNL injection vulnerability that would allow an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance by sending a specially crafted HTTP request.

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if 'Allow people to sign up to create their account' is enabled.

The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.23, 6.14.x prior to 7.4.11, 7.5.x prior to 7.11.6 or 7.12.x prior to 7.12.5. It is, therefore, affected by an OGNL injection vulnerability that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
112964	Atlassian Confluence 7.12.x < 7.12.5 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	critical
112963	Atlassian Confluence 7.5.x < 7.11.6 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	critical
112962	Atlassian Confluence 6.14.x < 7.4.11 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	critical
112961	Atlassian Confluence < 6.13.23 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	critical
153087	Atlassian Confluence Server Webwork OGNL Injection (CVE-2021-26084)	Nessus	CGI abuses	critical
112944	Atlassian Confluence Webwork OGNL Injection	Web App Scanning	Component Vulnerability	critical
152864	Atlassian Confluence < 6.13.23 / 6.14 < 7.4.11 / 7.5 < 7.11.6 / 7.12 < 7.12.5 Webwork OGNL Injection (CONFSERVER-67940)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2021-26084

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical