CVE-2021-43940

State: Published
Severity: 7.8 High
Published: Feb 15, 2022
Updated: Oct 8, 2024
Reserved: Nov 16, 2021

Description

Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-427 Uncontrolled Search Path Element (CWE-427)

Affected Products

Product	Versions
Confluence ServerAtlassian	before 7.4.10Affected 7.5.0 to before unspecifiedAffected before 7.12.3Affected
Confluence Data CenterAtlassian	before 7.4.10Affected 7.5.0 to before unspecifiedAffected before 7.12.3Affected

References

https://jira.atlassian.com/browse/CONFSERVER-66550

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.