CVE-2021-26072

MEDIUM EXPLOITED NUCLEI

Atlassian Confluence Data Center < 5.8.6 - SSRF

Title source: rule

Description

The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.

Nuclei Templates (1)

Atlassian Confluence < 5.8.6 - Server-Side Request Forgery

MEDIUMVERIFIEDby TechbrunchFR

Shodan: http.component:"Atlassian Confluence"

References (1)

[Issue Tracking, Patch, Vendor Advisory] https://jira.atlassian.com/browse/CONFSERVER-61399

Scores

CVSS v3 4.3

EPSS 0.2106

EPSS Percentile 95.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

VulnCheck KEV 2025-11-05

CWE

CWE-918

Status published

Products (2)

atlassian/confluence_data_center < 5.8.6

atlassian/confluence_server < 5.8.6

Published Apr 01, 2021

Tracked Since Feb 18, 2026