CVE-2021-26085mediumunder attackransomwareCWE-425

CVE-2021-26085: medium-severity vulnerability in Atlassian Confluence Server

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 5.3epss 100%
from disclosure to weapon63 days
Published on NVDAug 3
1st PoC+63d
CISA KEV+237d
exploitation probability
100%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
4 public exploit(s)
Action required by CISAfederal deadline: 2022-04-18

Apply updates per vendor instructions.

In short

Atlassian Confluence Server has a vulnerability that allows attackers to read files they shouldn't have access to by exploiting the /s/ endpoint. This means sensitive information could be exposed without proper authentication.

Technical detail

A pre-authorization arbitrary file read vulnerability exists in the /s/ endpoint of Confluence Server versions before 7.4.10 and 7.5.0–7.12.2, allowing unauthenticated remote attackers to bypass access controls and retrieve restricted files. The vulnerability stems from insufficient authorization checks on file retrieval operations, potentially exposing sensitive configuration or user data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Atlassian · Confluence Data CenterAtlassian · Confluence Server
public PoCs found — 4
exploitdbwww.exploit-db.com/exploits/50377unverifiedgithubgithub.com/ColdFusionX/CVE-2021-26085★ 13vulncheckvulncheck.com/xdb/611d47c6f6fbunverifiedcve_referencepacketstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Atlassian Confluence Server

In the same product, most dangerous first.

CVE-2023-22518CRITICALCVE-2023-22518EPSS 100.0%KEVCVE-2022-26134CRITICALCVE-2022-26134EPSS 100.0%KEVCVE-2021-26084CRITICALCVE-2021-26084EPSS 100.0%KEVCVE-2023-22527CRITICALCVE-2023-22527EPSS 100.0%KEVCVE-2019-3396CRITICALCVE-2019-3396EPSS 99.9%KEVCVE-2023-22515CRITICALCVE-2023-22515EPSS 99.2%KEV
References
http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.htmlhttps://jira.atlassian.com/browse/CONFSERVER-67893https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26085