Confluence Server Webwork OGNL Injection
Date of Notice: 9/2/2021
Action Level -Critical
Description
MCNC would like to make you aware of a CRITICAL severity Confluence vulnerability that should be patched immediately.
CVE-2021-26084 is a remote code injection vulnerability affecting many versions of Confluence and is scored a 9.8/10. Further this vulnerability is actively being exploited.
Affected Devices
Various versions of Confluence preceding the following patched versions:
- 6.13.23
- 7.4.11
- 7.11.6
- 7.12.5
- 7.13.0
The full list of affected versions is on Atlassian's webpage, here.
Attack Vector
Attackers with network access to the Confluence server.
Attack Feasibility
This vulnerability is actively being exploited, the feasibility of an internet facing Confluence server being exploited is high.
Mitigations
Confluence has a powershell script to mitigate if absolutely unable to patch/upgrade. It is on their page under mitigations, here.
Remediation
Upgrade/patch to a secure version of Confluence.