github - ghsa-vcmw-wwpg-fvfx

ghsa-vcmw-wwpg-fvfx

Vulnerability from github

Published

2024-03-19 18:32

Modified

2024-03-19 18:32

Severity ?

8.3 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version and that Confluence Server customers upgrade to the latest 8.5.x LTS version.

If you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html

You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives.

This vulnerability was reported via our Bug Bounty program.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-21677"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-19T17:15:09Z",
    "severity": "HIGH"
  },
  "details": "This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\n\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version and that Confluence Server customers upgrade to the latest 8.5.x LTS version.\n\nIf you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html\n\nYou can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. \n\nThis vulnerability was reported via our Bug Bounty program.",
  "id": "GHSA-vcmw-wwpg-fvfx",
  "modified": "2024-03-19T18:32:01Z",
  "published": "2024-03-19T18:32:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21677"
    },
    {
      "type": "WEB",
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1369444862"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-94604"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-21677

Vulnerability from cvelistv5

Published

2024-03-19 17:00

Modified

2024-08-01 22:27

Severity ?

8.3 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version and that Confluence Server customers upgrade to the latest 8.5.x LTS version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was reported via our Bug Bounty program.

References

▼	URL	Tags
	https://confluence.atlassian.com/pages/viewpage.action?pageId=1369444862
	https://jira.atlassian.com/browse/CONFSERVER-94604

Impacted products

▼	Vendor	Product
	Atlassian	Confluence Data Center

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:atlassian:confluence_data_center:8.8.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "confluence_data_center",
            "vendor": "atlassian",
            "versions": [
              {
                "status": "affected",
                "version": "8.8.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:7.19.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:7.20.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:8.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:8.1.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:8.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:8.3.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:8.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:8.5:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:8.6.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "confluence_data_center",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "7.19.19",
                "status": "affected",
                "version": "7.19.0",
                "versionType": "custom"
              },
              {
                "lessThan": "7.20.3",
                "status": "affected",
                "version": "7.20.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.0.4",
                "status": "affected",
                "version": "8.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.1.4",
                "status": "affected",
                "version": "8.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.2.3",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.3.4",
                "status": "affected",
                "version": "8.3.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.4.5",
                "status": "affected",
                "version": "8.4.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.5.6",
                "status": "affected",
                "version": "8.5",
                "versionType": "custom"
              },
              {
                "lessThan": "8.6.2",
                "status": "affected",
                "version": "8.6.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.7.2",
                "status": "affected",
                "version": "8.7.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:atlassian:confluence_data_center:7.17.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "confluence_data_center",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "7.17.5",
                "status": "affected",
                "version": "7.17.0",
                "versionType": "custom"
              },
              {
                "lessThan": "7.18.3",
                "status": "affected",
                "version": "7.18.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:atlassian:confluence_data_center:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "confluence_data_center",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "7.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21677",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T04:00:27.568364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-21T18:07:46.098Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:35.969Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1369444862"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-94604"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003c 6.13.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.13.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.19.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.20.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.6.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.7.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.8.0"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 7.19.20"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.5.7"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.\n\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version and that Confluence Server customers upgrade to the latest 8.5.x LTS version.\n\nIf you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html\n\nYou can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. \n\nThis vulnerability was reported via our Bug Bounty program."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "Other"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-19T17:30:00.500Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1369444862"
        },
        {
          "url": "https://jira.atlassian.com/browse/CONFSERVER-94604"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2024-21677",
    "datePublished": "2024-03-19T17:00:00.486Z",
    "dateReserved": "2024-01-01T00:05:33.846Z",
    "dateUpdated": "2024-08-01T22:27:35.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted