Riskcovery

CVE-2024-21686

State
Published
Severity
7.3 High
Published
Jul 16, 2024
Updated
Mar 19, 2025
Reserved
Jan 1, 2024

Read the record on cve.org

Description

This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server.

This Stored XSS vulnerability, with a CVSS Score of 7.3, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires user interaction.

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions listed on this CVE

See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives).

This vulnerability was reported via our Bug Bounty program.

Scores

CVSSScoreVectorSource
3.07.3 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Natlassian

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
Confluence Data CenterAtlassian
  • 8.9.0Affected
  • 8.8.0 to 8.8.1Affected
  • 8.7.1 to 8.7.2Affected
  • 8.6.0 to 8.6.2Affected
  • 8.5.0 to 8.5.8Affected
  • 8.4.0 to 8.4.5Affected
  • 8.3.0 to 8.3.4Affected
  • 8.2.0 to 8.2.3Affected
  • 8.1.0 to 8.1.4Affected
  • 8.0.0 to 8.0.4Affected
  • 7.20.0 to 7.20.3Affected
  • 7.19.0 to 7.19.21Affected
  • 8.9.1 to 8.9.4Not affected
  • 8.5.9 to 8.5.12Not affected
  • 7.19.22 to 7.19.25Not affected
Confluence ServerAtlassian
  • 8.5.0 to 8.5.8Affected
  • 8.4.0 to 8.4.5Affected
  • 8.3.0 to 8.3.4Affected
  • 8.2.0 to 8.2.3Affected
  • 8.1.0 to 8.1.4Affected
  • 8.0.0 to 8.0.4Affected
  • 7.20.0 to 7.20.3Affected
  • 7.19.0 to 7.19.21Affected
  • 8.5.9 to 8.5.12Not affected
  • 7.19.22 to 7.19.25Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.