CVE-2024-21677: atlassian confluence_data_center

Vulnerability summary

CVE-2024-21677 is a high (CVSS 8.8) vulnerability in atlassian confluence_data_center. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.5% of scored vulnerabilities. Fixed in 7.19.20, 8.5.7, 8.8.1.

Timeline

1. 19-03-2024
   PublishedVulnerability first disclosed.
2. 13-03-2025
   Last modifiedVulnerability information updated.

Description

This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version and that Confluence Server customers upgrade to the latest 8.5.x LTS version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was reported via our Bug Bounty program.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.