TI-2021-16504 Aliases CVE-2021-39114 GHSA-2grp-34h8-p48c

Code injection in Atlassian Confluence Server

MEDIUM 43CWE-94Published 2022-04-05 · Updated 2024-10-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01683 77th percentileScored 2026-11-07

Fix Fixed Confluence Server (Atlassian): 6.13.23, 7.4.11, 7.11.6 +1Confluence Data Center (Atlassian): 6.13.23, 7.4.11, 7.11.6 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Confluence Server	before 6.13.23; 6.14.0 and later; before 7.4.11; 7.5.0 and later; before 7.11.6; 7.12.0 and later; before 7.12.5	6.13.23, 7.4.11, 7.11.6, 7.12.5	Patch available	CNA
Atlassian	Confluence Data Center	before 6.13.23; 6.14.0 and later; before 7.4.11; 7.5.0 and later; before 7.11.6; 7.12.0 and later; before 7.12.5	6.13.23, 7.4.11, 7.11.6, 7.12.5	Patch available	CNA

Confluence Server VendorAtlassian Affected before 6.13.23; 6.14.0 and later; before 7.4.11; 7.5.0 and later; before 7.11.6; 7.12.0 and later; before 7.12.5 Fixed in 6.13.23, 7.4.11, 7.11.6, 7.12.5 Patch available CNA
Confluence Data Center VendorAtlassian Affected before 6.13.23; 6.14.0 and later; before 7.4.11; 7.5.0 and later; before 7.11.6; 7.12.0 and later; before 7.12.5 Fixed in 6.13.23, 7.4.11, 7.11.6, 7.12.5 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:confluence_data_center::::::::	before 6.13.23; 6.14.0 to before 7.4.11; 7.5.0 to before 7.11.6; 7.12.0 to before 7.12.5	Vulnerable	Atlassian
cpe:2.3:a:atlassian:confluence_server::::::::	before 6.13.23; 6.14.0 to before 7.4.11; 7.5.0 to before 7.11.6; 7.12.0 to before 7.12.5	Vulnerable	Atlassian

cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions before 6.13.23; 6.14.0 to before 7.4.11; 7.5.0 to before 7.11.6; 7.12.0 to before 7.12.5 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions before 6.13.23; 6.14.0 to before 7.4.11; 7.5.0 to before 7.11.6; 7.12.0 to before 7.12.5 Vulnerable ·Atlassian

Remediation

Fix · CNA Confluence Server (Atlassian) Fixed in 6.13.23, 7.4.11, 7.11.6, 7.12.5
Fix · CNA Confluence Data Center (Atlassian) Fixed in 6.13.23, 7.4.11, 7.11.6, 7.12.5

Timeline

2026-10-02 Threatist record created from CVE-2021-39114
2026-10-03 Alias added: GHSA-2grp-34h8-p48c

References

Advisory 1

https://jira.atlassian.com/browse/CONFSERVER-68844

TI-2023-08765 Injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2023-08757 Improper input validation in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2022-09596 Expression language injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2021-08036 Expression language injection in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
TI-2023-08759 Incorrect authorization in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences