Atlassian Confluence Server vulnerabilities

CVE-2023-22518 [CRITICAL] CWE-863 CVE-2023-22518: All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Th All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to

CVE-2022-26134 [CRITICAL] CWE-917 CVE-2022-26134: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists th In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2,

CVE-2021-26084 [CRITICAL] CWE-917 CVE-2021-26084: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists th In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from vers

CVE-2023-22527 [CRITICAL] CWE-74 CVE-2023-22527: A template injection vulnerability on older versions of Confluence Data Center and Server allows an A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ulti

CVE-2019-3396 [CRITICAL] CWE-22 CVE-2019-3396: The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version f The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path

CVE-2023-22515 [CRITICAL] CWE-20 CVE-2023-22515: Atlassian has been made aware of an issue reported by a handful of customers where external attacker Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affect

CVE-2019-3398 [HIGH] CWE-22 CVE-2019-3398: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments r Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locat

CVE-2021-26085 [MEDIUM] CWE-425 CVE-2021-26085: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

CVE-2024-21683 [HIGH] CWE-94 CVE-2024-21683: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Conflu This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availabi

CVE-2021-26072 [MEDIUM] CWE-918 CVE-2021-26072: The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allo The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.

CVE-2012-2926 [CRITICAL] CVE-2012-2926: Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; Fish Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of

CVE-2023-22522 [HIGH] CWE-74 CVE-2023-22522: This Template Injection vulnerability allows an authenticated attacker, including one with anonymous This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at ri

CVE-2022-26136 [CRITICAL] CWE-180 CVE-2022-26136: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass S A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released update

CVE-2019-3395 [CRITICAL] CWE-918 CVE-2019-3395: The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed v The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Cen

CVE-2023-22508 [HIGH] CVE-2023-22508: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high imp

CVE-2023-22505 [HIGH] CVE-2023-22505: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impa

CVE-2023-22526 [HIGH] CWE-94 CVE-2023-22526: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Con This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, an

CVE-2019-3394 [HIGH] CWE-22 CVE-2019-3394: There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under /confluence/WEB-INF directory, which may contain configuration files used for integrating with other services, which could

CVE-2021-39114 [HIGH] CWE-94 CVE-2021-39114: Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and fr

CVE-2024-21673 [HIGH] CWE-94 CVE-2024-21673: This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Co This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.0 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H allows an authenticated attacker to expose assets in your environment susceptible to e