Lucene search

K
atlassianSecurity-metrics-botCONFSERVER-79016
HistoryJun 03, 2022 - 8:08 p.m.

Remote code execution via OGNL injection in Confluence Server & Data Center - CVE-2022-26134

2022-06-0320:08:07
security-metrics-bot
jira.atlassian.com
52

0.975 High

EPSS

Percentile

100.0%

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
 
The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
 
For more information, see https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html