CVE-2024-21672
Published: 16 January 2024
Summary
CVE-2024-21672 is a high-severity Code Injection (CWE-94) vulnerability in Atlassian Confluence Data Center. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-21672 is a high-severity remote code execution vulnerability in Atlassian Confluence Data Center and Server, introduced in version 2.1.0. It carries a CVSS score of 8.3–8.8 and is classified under CWE-94, allowing an unauthenticated attacker to execute arbitrary code on affected instances through improper control of code generation.
An unauthenticated remote attacker can exploit the flaw by sending a crafted request that triggers code execution, provided the victim interacts with a malicious link or resource. Successful exploitation grants high impact to confidentiality, integrity, and availability, enabling full compromise of the Confluence instance and exposure of connected assets.
Atlassian’s security bulletin directs customers to upgrade Confluence Data Center and Server to fixed releases including 7.19.18 or later in the 7.19.x line, 8.5.5 or later in the 8.5.x line, or 8.7.2 or later, with release notes and downloads available from the vendor’s sites.
The EPSS score has remained flat at 0.0718 with no material increase since disclosure, and no confirmed real-world exploitation activity is reported in the available data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19288
Vulnerability details
This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker…
more
to remotely expose assets in your environment susceptible to exploitation which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Confluence Data Center and Server 7.19: Upgrade to a release 7.19.18, or any higher 7.19.x release * Confluence Data Center and Server 8.5: Upgrade to a release 8.5.5 or any higher 8.5.x release * Confluence Data Center and Server 8.7: Upgrade to a release 8.7.2 or any higher release See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html ). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.