CVE · Exploited · On CISA KEV

CVE-2021-26084

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

9.8: CVSS 3.1
1: story
NOV 3: added to KEV

Severity: 9.8 Critical · NVD score
Vendor: Atlassian
Product: Confluence Server and Data Center
Published: Aug 30, 2021
Added to KEV: Nov 3, 2021
KEV deadline: Nov 17, 2021
Ransomware use: Known
Weakness: CWE-917

What it is

Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

DEC 16
IntrusionsRussian Hackers Target Misconfigured Edge Devices in ‘Concerning Evolution’ For Critical Infrastructure AttacksAmazon researchers highlighted a “tactical pivot” by Russian GRU hackers who have been moving away from zero-day and N-day exploitation.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixjira.atlassian.com/browse/CONFSERVER-67940 Fixjira.atlassian.com/browse/CONFSERVER-67940 Exploitpacketstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html Exploitpacketstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html