CVE-2024-21683
Reported by atlassian · Published May 21, 2024
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| confluence_data_center | atlassian | 8.9.3, 8.6.2, 8.5.11, 8.4.5, 8.3.4, 8.2.3, 8.1.4, 8.0.4, 7.20.3, 7.19.24 |
| crucible | atlassian | 4.8.15 |
| com.google.code.gson:gson | n/a | 2.8.9 |
| fisheye | atlassian | 4.8.15 |
| confluence_server | atlassian | 8.9.2, 8.6.2, 8.5.11, 8.4.5, 8.3.4, 8.2.3, 8.1.4, 8.0.4, 7.20.3, 7.19.24 |
| jira_server | atlassian | 9.12.8, 9.4.21 |
| jira_data_center | atlassian | 9.12.8, 9.4.21 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Confluence Data Center | 8.9.0, 8.8.0 to 8.8.1, 8.7.1 to 8.7.2 |
| Atlassian | Confluence Data Center | 8.9.0, 8.8.0, 8.7.1 |
| atlassian | confluence_data_center | 8.9.0, 8.8.0, 8.7.1 |
Timeline
- May 21, 2024 Metasploit Module
- May 21, 2024 CVE Published
- May 22, 2024 EPSS Score (30 in total, the first dated here)
- May 23, 2024 VulnCheck KEV Exploitation (47 in total, the first dated here)
- May 23, 2024 VulnCheck XDB Entry (5 in total, the first dated here)
- May 24, 2024 Nuclei Template
- May 24, 2024 Fix Commit
- Jul 11, 2024 PoC Published (18 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (13 in total, the first dated here)
- Apr 15, 2026 Security Advisory (2 in total, the first dated here)
- Apr 15, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-21683
vulnetix vdb fixes CVE-2024-21683Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-21683/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart