8.8

CVE-2024-21683: atlassian confluence_data_center Improper Control of Generation of Code

Modified
Published 21-05-2024Last modified 12-05-2025

Vulnerability summary

CVE-2024-21683 is a high (CVSS 8.8) Improper Control of Generation of Code vulnerability in atlassian confluence_data_center. EPSS estimates a 88.27% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 21-05-2024)

Source freshness unavailable

How is this decided?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
88.27%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1metasploit

Timeline

  1. 21-05-2024
    PublishedVulnerability first disclosed.
  2. 12-05-2025
    Last modifiedVulnerability information updated.

Description

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

88.27%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 88.27% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    Atlassian Confluence Administrator Code Macro Remote Code Execution

    exploit/multi/http/atlassian_confluence_rce_cve_2024_21683

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian7 products
  • confluence_data_center8.9.0 | 8.8.0 to 8.8.1 | 8.7.1 to 8.7.2 | 8.6.0 to 8.6.2 | 8.5.0 to 8.5.8 | 8.4.0 to 8.4.5 | 8.3.0 to 8.3.4 | 8.2.0 to 8.2.3 | 8.1.0 to 8.1.4 | 8.0.0 to 8.0.4 | 7.20.0 to 7.20.3 | 7.19.0 to 7.19.21 | ≥ 7.19.0, < 7.19.24 | ≥ 7.20.0, ≤ 7.20.3 | ≥ 8.0.0, ≤ 8.0.4 | ≥ 8.1.0, ≤ 8.1.4 | ≥ 8.2.0, ≤ 8.2.3 | ≥ 8.3.0, ≤ 8.3.4 | ≥ 8.4.0, ≤ 8.4.5 | ≥ 8.5.0, < 8.5.11 | ≥ 8.6.0, ≤ 8.6.2 | ≥ 8.9.0, < 8.9.3 | 8.7.1 | 8.7.2 | 8.8.0 | 8.8.1
  • confluence_server≥ 7.19.0, < 7.19.24 | ≥ 7.20.0, ≤ 7.20.3 | ≥ 8.0.0, ≤ 8.0.4 | ≥ 8.1.0, ≤ 8.1.4 | ≥ 8.2.0, ≤ 8.2.3 | ≥ 8.3.0, ≤ 8.3.4 | ≥ 8.4.0, ≤ 8.4.5 | ≥ 8.5.0, < 8.5.11 | ≥ 8.6.0, ≤ 8.6.2 | ≥ 8.9.0, ≤ 8.9.2 | 8.7.1 | 8.7.2 | 8.8.0 | 8.8.1
  • crucible≥ 4.8.0, < 4.8.15
  • fisheye≥ 4.8.0, < 4.8.15
  • jira_data_center≥ 9.4.0, < 9.4.21 | ≥ 9.12.0, < 9.12.8

1 vendor · 7 products

References

2 links