According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.23, 6.14.x prior to 7.4.11, 7.5.x prior to 7.11.6 or 7.12.x prior to 7.12.5. It is, therefore, affected by an OGNL injection vulnerability that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if 'Allow people to sign up to create their account' is enabled.

The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.23, 6.14.x prior to 7.4.11, 7.5.x prior to 7.11.6 or 7.12.x prior to 7.12.5. It is, therefore, affected by an OGNL injection vulnerability that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Atlassian Confluence application running on the remote host is affected by an OGNL injection vulnerability that would allow an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance by sending a specially crafted HTTP request.

ID	Name	Product	Family	Published	Updated	Severity
112963	Atlassian Confluence 7.5.x < 7.11.6 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	9/10/2021	3/14/2023	critical
112961	Atlassian Confluence < 6.13.23 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	9/10/2021	3/14/2023	critical
112962	Atlassian Confluence 6.14.x < 7.4.11 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	9/10/2021	3/14/2023	critical
112944	Atlassian Confluence Webwork OGNL Injection	Web App Scanning	Component Vulnerability	9/1/2021	10/8/2021	critical
112964	Atlassian Confluence 7.12.x < 7.12.5 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	9/10/2021	3/14/2023	critical
152864	Atlassian Confluence < 6.13.23 / 6.14 < 7.4.11 / 7.5 < 7.11.6 / 7.12 < 7.12.5 Webwork OGNL Injection (CONFSERVER-67940)	Nessus	CGI abuses	8/26/2021	6/5/2024	critical
153087	Atlassian Confluence Server Webwork OGNL Injection (CVE-2021-26084)	Nessus	CGI abuses	9/7/2021	11/22/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical