CVE-2024-21683

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21683
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-95832 Issue Tracking
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.1:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.1:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:lts:*:*:*

Configuration 6 (hide)

OR cpe:2.3:a:atlassian:jira_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:lts:*:*:*

Configuration 7 (hide)

OR cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*

Configuration 8 (hide)

OR cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*
cpe:2.3:a:atlassian:jira_service_management:5.15.2:*:*:*:server:*:*:*
History

10 Apr 2025, 19:54

Type Values Removed Values Added
References () https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 - () https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 - Vendor Advisory
References () https://jira.atlassian.com/browse/CONFSERVER-95832 - () https://jira.atlassian.com/browse/CONFSERVER-95832 - Issue Tracking
First Time Atlassian fisheye
Atlassian jira Server
Atlassian confluence Server
Atlassian confluence Data Center
Atlassian
Atlassian jira Service Management
Atlassian crucible
Atlassian jira Data Center
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:atlassian:confluence_data_center:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:jira_service_management:5.15.2:*:*:*:server:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*

14 Mar 2025, 21:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

14 Mar 2025, 16:15

Type Values Removed Values Added
Summary
  • (es) Esta vulnerabilidad RCE (ejecución remota de código) de alta gravedad se introdujo en la versión 5.2 de Confluence Data Center and Server. Esta vulnerabilidad RCE (ejecución remota de código), con una puntuación CVSS de 8,3, permite a un atacante autenticado ejecutar código arbitrario que tiene un alto impacto en la confidencialidad, un alto impacto en la integridad, un alto impacto en la disponibilidad y no requiere interacción del usuario. Atlassian recomienda que los clientes de Confluence Data Center y Server actualicen a la última versión. Si no puede hacerlo, actualice su instancia a una de las versiones fijas admitidas especificadas. Consulte las notas de la versión https://confluence.atlassian.com/doc/confluence-release-notes-327.html Puede descargar la última versión de Confluence Data Center and Server desde el centro de descargas https://www.atlassian.com /software/confluence/descargar-archivos. Esta vulnerabilidad se encontró internamente.
Summary (en) Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record. (en) This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.
References
  • () https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211 -
  • () https://jira.atlassian.com/browse/CONFSERVER-95832 -

01 Jan 2025, 00:15

Type Values Removed Values Added
CWE NVD-CWE-noinfo
Summary
  • (es) Esta vulnerabilidad RCE (ejecución remota de código) de alta gravedad se introdujo en la versión 5.2 de Confluence Data Center and Server. Esta vulnerabilidad RCE (ejecución remota de código), con una puntuación CVSS de 8,3, permite a un atacante autenticado ejecutar código arbitrario que tiene un alto impacto en la confidencialidad, un alto impacto en la integridad, un alto impacto en la disponibilidad y no requiere interacción del usuario. Atlassian recomienda que los clientes de Confluence Data Center y Server actualicen a la última versión. Si no puede hacerlo, actualice su instancia a una de las versiones fijas admitidas especificadas. Consulte las notas de la versión https://confluence.atlassian.com/doc/confluence-release-notes-327.html Puede descargar la última versión de Confluence Data Center and Server desde el centro de descargas https://www.atlassian.com /software/confluence/descargar-archivos. Esta vulnerabilidad se encontró internamente.
Summary (en) This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.  Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally. (en) Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.
References
  • {'url': 'https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145', 'tags': ['Release Notes', 'Vendor Advisory'], 'source': 'af854a3a-2127-422b-91ae-364da2661108'}
  • {'url': 'https://jira.atlassian.com/browse/CONFSERVER-95832', 'tags': ['Issue Tracking'], 'source': 'af854a3a-2127-422b-91ae-364da2661108'}
  • {'url': 'https://packetstormsecurity.com/files/179507', 'source': 'af854a3a-2127-422b-91ae-364da2661108'}
CPE cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:lts:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.8.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.9.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:8.7.2:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_data_center:8.9.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:lts:*:*:*
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : unknown
Information

Published : 2024-05-21 23:15

Updated : 2025-04-10 19:54

NVD link : CVE-2024-21683

Mitre link : CVE-2024-21683

CVE.ORG link : CVE-2024-21683

JSON object : View

Products Affected

atlassian

  • jira_service_management
  • crucible
  • confluence_data_center
  • jira_server
  • fisheye
  • jira_data_center
  • confluence_server
CWE
NVD-CWE-noinfo