CVE-2021-26084
Atlassian Confluence Server and Data Center: Object-Graph Navigation Language (OGNL) Injection
As of , CVE-2021-26084 in Atlassian Confluence Server and Data Center is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 3 November 2021
- US federal deadline
- 17 November 202114 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Known
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
- Public exploit
- 1 Metasploit module and 1 Exploit-DB entry
- Fix
- No vendor link in CISA's entry
What CISA says to do
Apply updates per vendor instructions.
CISA's required action
What the flaw is
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
CISA's description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
The CVE record's description, from atlassian
- CVE published
- 30 August 2021
- Assigned by
- atlassian
- CVSS
- 9.8 Critical (CVSS 3.1, from CISA-ADP)
- CWE-917
- Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- Exploit-DB published an exploit (EDB-ID 50243).
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: Atlassian Confluence WebWork OGNL Injectionexploit module, rank excellent
- Exploit-DB: Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)EDB-ID 50243, 1 September 2021
Confluence Server and Data Center: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2019-3398Path Traversal | Atlassian Confluence Server and Data Center | Patch this weekEPSS 0.97 | 0.97 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org