CVE-2021-39114

Description

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.361

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-39114 are affected in Atlassian Confluence 6.9.3	Windows
Vulnerabilities CVE-2021-39114 are affected in Atlassian Confluence 7.12.4	Windows
Vulnerabilities CVE-2021-39114 are affected in Atlassian Confluence 7.4.10	Windows
Vulnerabilities CVE-2021-26084,CVE-2021-39114,CVE-2021-43940 are affected in Atlassian Confluence 7.9.3	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234