CVE-2021-39114

HIGH

Atlassian Confluence Data Center < 6.13.23 - Code Injection

Title source: rule

Description

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

References (1)

Core 1

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://jira.atlassian.com/browse/CONFSERVER-68844

Scores

CVSS v3 8.8

EPSS 0.0036

EPSS Percentile 58.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-94

Status published

Products (2)

atlassian/confluence_data_center < 6.13.23

atlassian/confluence_server < 6.13.23

Published Apr 05, 2022

Tracked Since Feb 18, 2026