ByteOS Network

Vulnerability Details :

CVE-2024-21674

Assigner Org ID-f08a6ab8-ed46-4c22-8884-d911ccfe3c66

Published At-16 Jan, 2024 | 05:00

Updated At-29 Aug, 2024 | 14:38

This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to confidentiality, no impact to integrity, no impact to availability, and does not require user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Confluence Data Center and Server 7.19: Upgrade to a release 7.19.18, or any higher 7.19.x release * Confluence Data Center and Server 8.5: Upgrade to a release 8.5.5 or any higher 8.5.x release * Confluence Data Center and Server 8.7: Upgrade to a release 8.7.2 or any higher release See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html ). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives ).

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:atlassian

Assigner Org ID:f08a6ab8-ed46-4c22-8884-d911ccfe3c66

Published At:16 Jan, 2024 | 05:00

Updated At:29 Aug, 2024 | 14:38

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

Atlassian

Product

Confluence Data Center

Versions

Affected

>= 7.19.0
>= 8.0.0
>= 8.1.0
>= 8.2.0
>= 8.3.0
>= 8.4.0
>= 8.5.0
>= 8.6.0
>= 8.7.1

Unaffected

< 7.19.0
>= 7.19.18
>= 8.5.5
>= 8.7.2

Vendor

Atlassian

Product

Confluence Server

Versions

Affected

>= 7.19.0
>= 8.0.0
>= 8.1.0
>= 8.2.0
>= 8.3.0
>= 8.4.0
>= 8.5.0
>= 8.6.0
>= 8.7.1

Unaffected

< 7.19.0
>= 7.19.18
>= 8.5.5

Problem Types

Type	CWE ID	Description
RCE (Remote Code Execution)	N/A	RCE (Remote Code Execution)

Type: RCE (Remote Code Execution)

CWE ID: N/A

Description: RCE (Remote Code Execution)

Metrics

Version	Base score	Base severity	Vector
3.0	8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Version: 3.0

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Credits

DDV_UA

References

Hyperlink	Resource
https://jira.atlassian.com/browse/CONFSERVER-94066	N/A

Hyperlink: https://jira.atlassian.com/browse/CONFSERVER-94066

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://jira.atlassian.com/browse/CONFSERVER-94066	x_transferred

Hyperlink: https://jira.atlassian.com/browse/CONFSERVER-94066

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-94	CWE-94 Improper Control of Generation of Code ('Code Injection')

Type: CWE

CWE ID: CWE-94

Description: CWE-94 Improper Control of Generation of Code ('Code Injection')

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@atlassian.com

Published At:16 Jan, 2024 | 05:15

Updated At:29 Aug, 2024 | 20:36

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary	3.0	8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.0

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CPE Matches

Atlassian

>>confluence_data_center>>Versions from 7.19.0(inclusive) to 7.19.18(exclusive)

cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*

Atlassian

>>confluence_data_center>>Versions from 8.5.0(inclusive) to 8.5.5(exclusive)

cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*

Atlassian

>>confluence_data_center>>Versions from 8.7.0(inclusive) to 8.7.2(exclusive)

cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*

Atlassian

>>confluence_server>>Versions from 7.19(inclusive) to 7.19.18(exclusive)

cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

Atlassian

>>confluence_server>>Versions from 8.5.0(inclusive) to 8.5.5(exclusive)

cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

Atlassian

>>confluence_server>>Versions from 8.7.0(inclusive) to 8.7.2(inclusive)

cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-94	Primary	nvd@nist.gov
CWE-94	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-94

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-94

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://confluence.atlassian.com/security/security-bulletin-january-16-2024-1333335615.html	nvd@nist.gov	Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-94066	security@atlassian.com	Permissions Required

Hyperlink: https://confluence.atlassian.com/security/security-bulletin-january-16-2024-1333335615.html

Source: nvd@nist.gov

Resource:

Vendor Advisory

Hyperlink: https://jira.atlassian.com/browse/CONFSERVER-94066

Source: security@atlassian.com

Resource:

Permissions Required

Similar CVEs

55Records found

CVE-2024-44757

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.11% / 30.37%

7 Day CHG~0.00%

Published-18 Nov, 2024 | 00:00

Updated-21 Nov, 2024 | 16:51

An arbitrary file download vulnerability in the component /Basics/DownloadInpFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary files and access sensitive information via a crafted interface request.

Vendor-n/a erp

Product-n/a management_software

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2018-14716

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-73.35% / 98.74%

7 Day CHG~0.00%

Published-06 Aug, 2018 | 20:00

Updated-05 Aug, 2024 | 09:38

A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.

Vendor-nystudio107 n/a

Product-seomatic n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-50715

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-1.20% / 78.10%

7 Day CHG~0.00%

Published-27 Dec, 2024 | 00:00

Updated-21 Apr, 2025 | 15:18

An issue in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via command injection through a vulnerable unsanitized parameter defined in the /youtubeInfo.php component.

Vendor-smarts-srl n/a

Product-smart_agent n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-24278

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.11% / 29.64%

7 Day CHG~0.00%

Published-05 Mar, 2024 | 00:00

Updated-23 May, 2025 | 14:45

An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function.

Vendor-teamwire n/a teamwire Microsoft Corporation

Product-windows teamwire n/a teamwire

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2017-18924

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.19% / 41.33%

7 Day CHG~0.00%

Published-04 Oct, 2020 | 04:38

Updated-05 Aug, 2024 | 22:15

oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.

Vendor-oauth2-server_project n/a

Product-oauth2-server n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2024-21674

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Unaffected

Affected

Unaffected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs