CVE-2024-21678

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction. Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||Affected versions||Fixed versions|| |from 8.7.0 to 8.7.1|8.8.0 recommended or 8.7.2| |from 8.6.0 to 8.6.1|8.8.0 recommended| |from 8.5.0 to 8.5.4 LTS|8.8.0 recommended or 8.5.5 LTS or 8.5.6 LTS| |from 8.4.0 to 8.4.5|8.8.0 recommended or 8.5.6 LTS| |from 8.3.0 to 8.3.4|8.8.0 recommended or 8.5.6 LTS| |from 8.2.0 to 8.2.3|8.8.0 recommended or 8.5.6 LTS| |from 8.1.0 to 8.1.4|8.8.0 recommended or 8.5.6 LTS| |from 8.0.0 to 8.0.4|8.8.0 recommended or 8.5.6 LTS| |from 7.20.0 to 7.20.3|8.8.0 recommended or 8.5.6 LTS| |from 7.19.0 to 7.19.17 LTS|8.8.0 recommended or 8.5.6 LTS or 7.19.18 LTS or 7.19.19 LTS| |from 7.18.0 to 7.18.3|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| |from 7.17.0 to 7.17.5|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| |Any earlier versions|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS| Server Atlassian recommends that Confluence Server customers upgrade to the latest 8.5.x LTS version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions: ||Affected versions||Fixed versions|| |from 8.5.0 to 8.5.4 LTS|8.5.5 LTS or 8.5.6 LTS recommended | |from 8.4.0 to 8.4.5|8.5.6 LTS recommended| |from 8.3.0 to 8.3.4|8.5.6 LTS recommended| |from 8.2.0 to 8.2.3|8.5.6 LTS recommended| |from 8.1.0 to 8.1.4|8.5.6 LTS recommended| |from 8.0.0 to 8.0.4|8.5.6 LTS recommended| |from 7.20.0 to 7.20.3|8.5.6 LTS recommended| |from 7.19.0 to 7.19.17 LTS|8.5.6 LTS recommended or 7.19.18 LTS or 7.19.19 LTS| |from 7.18.0 to 7.18.3|8.5.6 LTS recommended or 7.19.19 LTS| |from 7.17.0 to 7.17.5|8.5.6 LTS recommended or 7.19.19 LTS| |Any earlier versions|8.5.6 LTS recommended or 7.19.19 LTS| See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Bug Bounty program.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606	Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-94513	Issue Tracking Vendor Advisory
https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606	Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-94513	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_data_center::::::::
	cpe:2.3:a:atlassian:confluence_server::::::::
	cpe:2.3:a:atlassian:confluence_server::::::::

History

06 May 2025, 14:52

Type	Values Removed	Values Added
References	~~() https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606 -~~	() https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606 - Vendor Advisory
References	~~() https://jira.atlassian.com/browse/CONFSERVER-94513 -~~	() https://jira.atlassian.com/browse/CONFSERVER-94513 - Issue Tracking, Vendor Advisory
CPE		cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_server::::::::
First Time		Atlassian Atlassian confluence Data Center Atlassian confluence Server

21 Nov 2024, 08:54

Type	Values Removed	Values Added
References	~~() https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606 -~~	() https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606 -
References	~~() https://jira.atlassian.com/browse/CONFSERVER-94513 -~~	() https://jira.atlassian.com/browse/CONFSERVER-94513 -

31 Oct 2024, 16:35

Type	Values Removed	Values Added
CWE		CWE-79
Summary		(es) Esta vulnerabilidad XSS almacenada de alta gravedad se introdujo en la versión 2.7.0 de Confluence Data Center. Esta vulnerabilidad XSS almacenada, con una puntuación CVSS de 8,5, permite a un atacante autenticado ejecutar código HTML o JavaScript arbitrario en el navegador de una víctima, lo que tiene un alto impacto en la confidencialidad, un bajo impacto en la integridad, ningún impacto en la disponibilidad y no requiere interacción del usuario. Centro de datos Atlassian recomienda que los clientes de Confluence Data Center actualicen a la última versión. Si no puede hacerlo, actualice su instancia a una de las versiones fijas admitidas especificadas: \|\|Versiones afectadas\|\|Versiones fijas\|\| \|de 8.7.0 a 8.7.1\|se recomienda 8.8.0 o 8.7.2\| \|de 8.6.0 a 8.6.1\|se recomienda 8.8.0\| \|de 8.5.0 a 8.5.4 LTS\|se recomienda 8.8.0 o 8.5.5 LTS o 8.5.6 LTS\| \|de 8.4.0 a 8.4.5\|se recomienda 8.8.0 o 8.5.6 LTS\| \|de 8.3.0 a 8.3.4\|se recomienda 8.8.0 o 8.5.6 LTS\| \|de 8.2.0 a 8.2.3\|se recomienda 8.8.0 o 8.5.6 LTS\| \|de 8.1.0 a 8.1.4\|se recomienda 8.8.0 o 8.5.6 LTS\| \|de 8.0.0 a 8.0.4\|se recomienda 8.8.0 o 8.5.6 LTS\| \|de 7.20.0 a 7.20.3\|se recomienda 8.8.0 o 8.5.6 LTS\| \|de 7.19.0 a 7.19.17 LTS\|se recomienda 8.8.0 o 8.5.6 LTS o 7.19.18 LTS o 7.19.19 LTS\| \|de 7.18.0 a 7.18.3\|se recomienda 8.8.0 o 8.5.6 LTS o 7.19.19 LTS\| \|de 7.17.0 a 7.17.5\|se recomienda 8.8.0 o 8.5.6 LTS o 7.19.19 LTS\| \|Cualquier versión anterior\|se recomienda 8.8.0 o 8.5.6 LTS o 7.19.19 LTS\| Server Atlassian recomienda que los clientes de Confluence Server actualicen a la última versión 8.5.x LTS. Si no puede hacerlo, actualice su instancia a una de las versiones fijas admitidas especificadas: \|\|Versiones afectadas\|\|Versiones fijas\|\| \|de 8.5.0 a 8.5.4 LTS\|Se recomienda 8.5.5 LTS o 8.5.6 LTS \| \|de 8.4.0 a 8.4.5\|se recomienda 8.5.6 LTS\| \|de 8.3.0 a 8.3.4\|se recomienda 8.5.6 LTS\| \|de 8.2.0 a 8.2.3\|se recomienda 8.5.6 LTS\| \|de 8.1.0 a 8.1.4\|se recomienda 8.5.6 LTS\| \|de 8.0.0 a 8.0.4\|se recomienda 8.5.6 LTS\| \|de 7.20.0 a 7.20.3\|se recomienda 8.5.6 LTS\| \|de 7.19.0 a 7.19.17 LTS\|Se recomienda 8.5.6 LTS o 7.19.18 LTS o 7.19.19 LTS\| \|de 7.18.0 a 7.18.3\|Se recomienda 8.5.6 LTS o 7.19.19 LTS\| \|de 7.17.0 a 7.17.5\|Se recomienda 8.5.6 LTS o 7.19.19 LTS\| \|Cualquier versión anterior\|se recomienda 8.5.6 LTS o 7.19.19 LTS\| Consulte las notas de la versión ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). Puede descargar la última versión de Confluence Data Center desde el centro de descargas ([https://www.atlassian.com/software/confluence/download-archives]). Esta vulnerabilidad se informó a través de nuestro programa Bug Bounty.

20 Feb 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-20 18:15

Updated : 2025-05-06 14:52

NVD link : CVE-2024-21678

Mitre link : CVE-2024-21678

CVE.ORG link : CVE-2024-21678

JSON object : View

Products Affected

atlassian

confluence_data_center
confluence_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

8.5 /10