CVE-2024-21703

mediumPriorität · verfolgen · 0EPSS 0.002 · 10. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.20% (10th) EPSS

CVSS 6.4 · medium

Is it mine?

9 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · bewertet 2026-10-27

This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitive information about the Confluence Data Center configuration which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to the latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Confluence Data Center and Server 7.19: Upgrade to a release greater than or equal to 7.19.18 * Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.5 * Confluence Data Center and Server 8.7: Upgrade to a release greater than or equal to 8.7.2 * Confluence Data Center and Server 8.8: Upgrade to a release greater than or equal to 8.8.0 See the release notes (https://confluence.atlassian.com/conf88/confluence-release-notes-1354501008.html ). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives ). This vulnerability was reported via our Atlassian Bug Bounty Program by Chris Elliot.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.4

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.4mediumAV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.4mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.16.4mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 0.5 · Auswirkung 5.9

v3.15.9mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-732USCWE-732US

betroffene Produkte (9)

Betroffene Produkte und Versionsbereiche.

Atlassian Confluence Data Center≤ 8.7.1enisa_euvdEU
Atlassian Jira Data Center7.19.0 → 7.19.18fstec_bduRU
Atlassian Jira Data Center8.5.0 → 8.5.5fstec_bduRU
Atlassian Jira Data Center8.7.0 → 8.7.2fstec_bduRU
atlassian confluence data center< 7.19.18nvdUScpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
atlassian confluence data center8.5 → 8.5.5nvdUScpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
atlassian confluence data center8.7 → 8.7.2nvdUScpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
atlassian confluence server< 7.19.18nvdUScpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*
atlassian confluence server8.0.0 → 8.5.5nvdUScpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

veröffentlicht 2024-11-27geändert 2026-06-17

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

https://jira.atlassian.com/browse/CONFSERVER-98413Patchcnnvd
https://nvd.nist.gov/vuln/detail/CVE-2024-21703 cnnvd
https://jira.atlassian.com/browse/CONFSERVER-98413 enisa_euvd
https://jira.atlassian.com/browse/CONFSERVER-98413Issue TrackingVendor Advisorynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan