CVE-2024-21683
Published: 21 May 2024
Summary
CVE-2024-21683 is a high-severity Code Injection (CWE-94) vulnerability in Atlassian Confluence Data Center. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-21683 is a high-severity remote code execution vulnerability in Atlassian Confluence Data Center and Server, introduced in version 5.2. It carries a CVSS 3.1 score of 8.8 and stems from improper control of code generation (CWE-94), enabling an authenticated attacker to run arbitrary code on the affected instance.
An authenticated attacker with network access can exploit the flaw without user interaction to achieve full remote code execution, resulting in high impact to confidentiality, integrity, and availability of the Confluence instance.
Atlassian advises customers to upgrade Confluence Data Center and Server to the latest version or one of the supported fixed releases listed in the release notes; downloads are available from the vendor’s archive site. The vulnerability was discovered internally and has not been linked to external reports of active exploitation.
The associated EPSS score stands at 0.9405.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19299
Vulnerability details
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which…
more
has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.