What is CVE-2021-39114?

CVE-2021-39114 is a high-severity vulnerability in Atlassian Confluence Data Center, classified under Code Injection. CVSS score: 8.8/10. Published 2022-04-05.

How severe is CVE-2021-39114?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Atlassian Confluence Data Center

CVE-2021-39114

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.017 (75.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Atlassian Confluence Data Center — versions unspecified, 6.14.0, 7.5.0
Atlassian Confluence_data_center
Atlassian Confluence Server — versions unspecified, 6.14.0, 7.5.0
Atlassian Confluence_server

Weakness classification (CWE)

CWE-94 — Code Injection

References

security@atlassian.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2021-39114?: CVE-2021-39114 is a high-severity vulnerability in Atlassian Confluence Data Center, classified under Code Injection. CVSS score: 8.8/10. Published 2022-04-05.
How severe is CVE-2021-39114?: High severity. CVSS v3 base score is 8.8 out of 10.