The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center’s date center is related to deficiencies in the process of eliminating special elements from the output data used by the incoming component. This allows a perpetrator to execute arbitrary code.

🗓️ 02 Sep 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Confluence Server and Data Center flaw enables arbitrary code via crafted OGNL in output data.

Reporter	Title	Published	Views	Family All 129
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	4 Sep 202114:53	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	1 Sep 202107:15	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	1 Sep 202109:50	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	31 Aug 202116:33	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	18 Sep 202107:33	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	6 Oct 202123:24	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	1 Sep 202109:50	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	26 Oct 202106:01	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	31 Aug 202123:33	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	6 Oct 202123:24	–	githubexploit

Vulners

Node

atlassian confluence_serverRange<6.13.23

OR

atlassian confluence_serverRange6.14.0–7.4.11

OR

atlassian confluence_serverRange7.12.0–7.12.5

OR

atlassian confluence_serverRange7.5.0–7.11.6

OR

atlassian jira_data_centerRange<6.13.23

OR

atlassian jira_data_centerRange6.14.0–7.4.11

OR

atlassian jira_data_centerRange7.5.0–7.11.6

OR

atlassian jira_data_centerRange7.12.0–7.12.5

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-26084
jira	www.jira.atlassian.com/browse/CONFSERVER-67940
github	www.github.com/projectdiscovery/nuclei-templates/pull/2529/files
confluence	www.confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
github	www.github.com/httpvoid/writeups/blob/main/Confluence-RCE.md
packetstormsecurity	www.packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

18 Aug 2025 00:00Current

8High risk

Vulners AI Score8

CVSS 39.8

CVSS 210

EPSS0.99999

confluence server confluence data center arbitrary code execution ognl expression output data