CVE-2024-21683

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21683
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-95832 Issue Tracking
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.1:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.1:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:lts:*:*:*

Configuration 6 (hide)

OR cpe:2.3:a:atlassian:jira_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:lts:*:*:*

Configuration 7 (hide)

OR cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*

Configuration 8 (hide)

OR cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*
cpe:2.3:a:atlassian:jira_service_management:5.15.2:*:*:*:server:*:*:*
History

10 Apr 2025, 19:54

Type Values Removed Values Added
References () https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 - () https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 - Vendor Advisory
References () https://jira.atlassian.com/browse/CONFSERVER-95832 - () https://jira.atlassian.com/browse/CONFSERVER-95832 - Issue Tracking
CPE cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:jira_service_management:5.15.2:*:*:*:server:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*
First Time Atlassian jira Server
Atlassian confluence Data Center
Atlassian jira Data Center
Atlassian fisheye
Atlassian jira Service Management
Atlassian confluence Server
Atlassian
Atlassian crucible
CWE NVD-CWE-noinfo

14 Mar 2025, 21:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

14 Mar 2025, 16:15

Type Values Removed Values Added
References
  • () https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 -
  • () https://jira.atlassian.com/browse/CONFSERVER-95832 -
Summary
  • (es) Esta vulnerabilidad RCE (ejecución remota de código) de alta gravedad se introdujo en la versión 5.2 de Confluence Data Center and Server. Esta vulnerabilidad RCE (ejecución remota de código), con una puntuación CVSS de 8,3, permite a un atacante autenticado ejecutar código arbitrario que tiene un alto impacto en la confidencialidad, un alto impacto en la integridad, un alto impacto en la disponibilidad y no requiere interacción del usuario. Atlassian recomienda que los clientes de Confluence Data Center y Server actualicen a la última versión. Si no puede hacerlo, actualice su instancia a una de las versiones fijas admitidas especificadas. Consulte las notas de la versión https://confluence.atlassian.com/doc/confluence-release-notes-327.html Puede descargar la última versión de Confluence Data Center and Server desde el centro de descargas https://www.atlassian.com /software/confluence/descargar-archivos. Esta vulnerabilidad se encontró internamente.
Summary (en) Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record. (en) This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.

01 Jan 2025, 00:15

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.9.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.9.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : unknown
Summary
  • (es) Esta vulnerabilidad RCE (ejecución remota de código) de alta gravedad se introdujo en la versión 5.2 de Confluence Data Center and Server. Esta vulnerabilidad RCE (ejecución remota de código), con una puntuación CVSS de 8,3, permite a un atacante autenticado ejecutar código arbitrario que tiene un alto impacto en la confidencialidad, un alto impacto en la integridad, un alto impacto en la disponibilidad y no requiere interacción del usuario. Atlassian recomienda que los clientes de Confluence Data Center y Server actualicen a la última versión. Si no puede hacerlo, actualice su instancia a una de las versiones fijas admitidas especificadas. Consulte las notas de la versión https://confluence.atlassian.com/doc/confluence-release-notes-327.html Puede descargar la última versión de Confluence Data Center and Server desde el centro de descargas https://www.atlassian.com /software/confluence/descargar-archivos. Esta vulnerabilidad se encontró internamente.
Summary (en) This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally. (en) Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.
CWE NVD-CWE-noinfo
References
  • {'url': 'https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145', 'tags': ['Release Notes', 'Vendor Advisory'], 'source': 'af854a3a-2127-422b-91ae-364da2661108'}
  • {'url': 'https://jira.atlassian.com/browse/CONFSERVER-95832', 'tags': ['Issue Tracking'], 'source': 'af854a3a-2127-422b-91ae-364da2661108'}
  • {'url': 'https://packetstormsecurity.com/files/179507', 'source': 'af854a3a-2127-422b-91ae-364da2661108'}

21 Nov 2024, 08:54

Type Values Removed Values Added
References
  • () https://packetstormsecurity.com/files/179507 -
References () https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145 - Release Notes, Vendor Advisory () https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145 - Release Notes, Vendor Advisory
References () https://jira.atlassian.com/browse/CONFSERVER-95832 - Issue Tracking () https://jira.atlassian.com/browse/CONFSERVER-95832 - Issue Tracking

10 Jun 2024, 18:15

Type Values Removed Values Added
Summary (en) This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.3, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally. (en) This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.

04 Jun 2024, 14:30

Type Values Removed Values Added
References () https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145 - () https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145 - Release Notes, Vendor Advisory
References () https://jira.atlassian.com/browse/CONFSERVER-95832 - () https://jira.atlassian.com/browse/CONFSERVER-95832 - Issue Tracking
CPE cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.9.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.9.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.1:*:*:*:*:*:*:*
Summary
  • (es) Esta vulnerabilidad RCE (ejecución remota de código) de alta gravedad se introdujo en la versión 5.2 de Confluence Data Center and Server. Esta vulnerabilidad RCE (ejecución remota de código), con una puntuación CVSS de 8,3, permite a un atacante autenticado ejecutar código arbitrario que tiene un alto impacto en la confidencialidad, un alto impacto en la integridad, un alto impacto en la disponibilidad y no requiere interacción del usuario. Atlassian recomienda que los clientes de Confluence Data Center y Server actualicen a la última versión. Si no puede hacerlo, actualice su instancia a una de las versiones fijas admitidas especificadas. Consulte las notas de la versión https://confluence.atlassian.com/doc/confluence-release-notes-327.html Puede descargar la última versión de Confluence Data Center and Server desde el centro de descargas https://www.atlassian.com /software/confluence/descargar-archivos. Esta vulnerabilidad se encontró internamente.
CWE NVD-CWE-noinfo
First Time Atlassian confluence Server
Atlassian
Atlassian confluence Data Center
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

21 May 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-21 23:15

Updated : 2025-04-10 19:54

NVD link : CVE-2024-21683

Mitre link : CVE-2024-21683

CVE.ORG link : CVE-2024-21683

JSON object : View

Products Affected

atlassian

  • fisheye
  • jira_service_management
  • jira_server
  • jira_data_center
  • confluence_server
  • confluence_data_center
  • crucible
CWE
NVD-CWE-noinfo