CVE-2024-21683

Published May 21, 2024 CVSS 3.1 · 7.2 High EPSS 88.3% KEV · Not listed

Description

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html

You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives.

This vulnerability was found internally.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Atlassian

Confluence Data Center

affected

Version	Status	Constraints
`8.9.0`	affected	—
`8.8.0 to 8.8.1`	affected	—
`8.7.1 to 8.7.2`	affected	—
`8.6.0 to 8.6.2`	affected	—
`8.5.0 to 8.5.8`	affected	—
`8.4.0 to 8.4.5`	affected	—
`8.3.0 to 8.3.4`	affected	—
`8.2.0 to 8.2.3`	affected	—
`8.1.0 to 8.1.4`	affected	—
`8.0.0 to 8.0.4`	affected	—
`7.20.0 to 7.20.3`	affected	—
`7.19.0 to 7.19.21`	affected	—
`8.9.1 to 8.9.2`	unaffected	—
`8.5.9 to 8.5.10`	unaffected	—
`7.19.22 to 7.19.23`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:atlassian:confluence_data_center:::::lts:::*
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center:::::lts:::*
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center:8.7.1:::::::*
	cpe:2.3:a:atlassian:confluence_data_center:8.7.2:::::::*
	cpe:2.3:a:atlassian:confluence_data_center:8.8.0:::::::*
	cpe:2.3:a:atlassian:confluence_data_center:8.8.1:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:atlassian:confluence_server:::::lts:::*
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server:::::lts:::*
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server:8.7.1:::::::*
	cpe:2.3:a:atlassian:confluence_server:8.7.2:::::::*
	cpe:2.3:a:atlassian:confluence_server:8.8.0:::::::*
	cpe:2.3:a:atlassian:confluence_server:8.8.1:::::::*

Configuration 3 [-]

cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

Configuration 4 [-]

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

Configuration 5 [-]

OR	cpe:2.3:a:atlassian:jira_data_center:::::lts:::*
	cpe:2.3:a:atlassian:jira_data_center:::::lts:::*

Configuration 6 [-]

OR	cpe:2.3:a:atlassian:jira_server:::::lts:::*
	cpe:2.3:a:atlassian:jira_server:::::lts:::*

Configuration 7 [-]

OR	cpe:2.3:a:atlassian:jira_service_management:::::data_center:::*
	cpe:2.3:a:atlassian:jira_service_management:::::data_center:::*
	cpe:2.3:a:atlassian:jira_service_management:::::data_center:::*

Configuration 8 [-]

OR	cpe:2.3:a:atlassian:jira_service_management:::::server:::*
	cpe:2.3:a:atlassian:jira_service_management:::::server:::*
	cpe:2.3:a:atlassian:jira_service_management:5.15.2::::server:::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 88.3% (88.267% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211
https://jira.atlassian.com/browse/CONFSERVER-95832

History

May 12, 2025 4:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-94
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 10, 2025 8:15 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Atlassian Atlassian confluence Data Center Atlassian confluence Server Atlassian crucible Atlassian fisheye Atlassian jira Data Center Atlassian jira Server Atlassian jira Service Management
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::lts:::* cpe:2.3:a:atlassian:confluence_data_center:8.7.1:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.7.2:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.8.0:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.8.1:::::::* cpe:2.3:a:atlassian:confluence_server:::::::: cpe:2.3:a:atlassian:confluence_server:::::lts:::* cpe:2.3:a:atlassian:confluence_server:8.7.1:::::::* cpe:2.3:a:atlassian:confluence_server:8.7.2:::::::* cpe:2.3:a:atlassian:confluence_server:8.8.0:::::::* cpe:2.3:a:atlassian:confluence_server:8.8.1:::::::* cpe:2.3:a:atlassian:crucible:::::::: cpe:2.3:a:atlassian:fisheye:::::::: cpe:2.3:a:atlassian:jira_data_center:::::lts:::* cpe:2.3:a:atlassian:jira_server:::::lts:::* cpe:2.3:a:atlassian:jira_service_management:::::data_center:::* cpe:2.3:a:atlassian:jira_service_management:::::server:::* cpe:2.3:a:atlassian:jira_service_management:5.15.2::::server:::
Vendors & Products		Atlassian Atlassian confluence Data Center Atlassian confluence Server Atlassian crucible Atlassian fisheye Atlassian jira Data Center Atlassian jira Server Atlassian jira Service Management

Mar 14, 2025 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mar 14, 2025 4:15 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.	This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.
References		https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 https://jira.atlassian.com/browse/CONFSERVER-95832

Jan 1, 2025 12:45 AM Weaknesses updated. Affected versions updated. Affected vendors updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses	NVD-CWE-noinfo
CPEs	cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::lts:::* cpe:2.3:a:atlassian:confluence_data_center:8.7.1:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.7.2:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.8.0:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.8.1:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.9.0:::::::* cpe:2.3:a:atlassian:confluence_server:::::::: cpe:2.3:a:atlassian:confluence_server:::::lts:::* cpe:2.3:a:atlassian:confluence_server:8.7.1:::::::* cpe:2.3:a:atlassian:confluence_server:8.7.2:::::::* cpe:2.3:a:atlassian:confluence_server:8.8.0:::::::* cpe:2.3:a:atlassian:confluence_server:8.8.1:::::::* cpe:2.3:a:atlassian:confluence_server:8.9.0:::::::*
Vendors & Products	Atlassian Atlassian confluence Data Center Atlassian confluence Server
References	https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145 https://jira.atlassian.com/browse/CONFSERVER-95832 https://packetstormsecurity.com/files/179507
Metrics	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Jan 1, 2025 12:15 AM Description updated View changes

Type	Values Removed	Values Added
Description	This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.	This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.