CVE-2021-43940
Atlassian Confluence Server
HIGH 7.8
En bref
- Source
- NVD
- EPSS
- EPSS 0.33 % · centile 26 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- atlassian
- Statut NVD
- Modified
Description
Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Faiblesses (CWE)
- CWE-427 — Élément de chemin de recherche non maîtrisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | MEDIUM 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-30802
- GCVE · GCVE-0-2021-43940
Configurations affectées (CPE NVD)
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*< 7.4.10cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*≥ 7.5.0 < 7.12.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*< 7.4.10cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 7.5.0 < 7.12.3
Produits affectés
| Produit | Versions |
|---|---|
| Atlassian · Confluence Server | affected unspecified < 7.4.10 ; affected 7.5.0 < unspecified ; affected unspecified < 7.12.3 |
| Atlassian · Confluence Data Center | affected unspecified < 7.4.10 ; affected 7.5.0 < unspecified ; affected unspecified < 7.12.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |