Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-21678
CVE-2024-21678:
Confluence Server vulnerability analysis and mitigation
Overview
A high-severity stored cross-site scripting (XSS) vulnerability, identified as CVE-2024-21678, was discovered in Atlassian Confluence Data Center and Server. The vulnerability was first introduced in version 2.7.0 of Confluence Data Center and carries a CVSS score of 8.5. This security flaw affects multiple versions of both Confluence Data Center and Server products, ranging from version 7.17.0 through 8.7.1 (Atlassian Advisory, CERT-EU).
Technical details
The vulnerability is classified as a stored XSS issue that allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser. The vulnerability has been assigned a CVSS v3.0 vector of CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network accessibility, low attack complexity, and required low privileges. The vulnerability has high impact on confidentiality, low impact on integrity, and no impact on availability, requiring no user interaction for exploitation (NVD, Atlassian Advisory).
Impact
Successful exploitation of this vulnerability can lead to significant security implications. The primary impacts include session hijacking where attackers could steal authentication credentials and session tokens, potentially leading to unauthorized access to sensitive Confluence data. Additionally, attackers could compromise data integrity by injecting malicious content, and use the vulnerability as a stepping stone for further network attacks (Security Online).
Mitigation and workarounds
Atlassian recommends that Confluence Data Center customers upgrade to version 8.8.0, 8.7.2, or 8.5.6 LTS. For Confluence Server users, upgrading to version 8.5.6 LTS is recommended. If unable to upgrade to these versions, users should upgrade to one of the specified supported fixed versions based on their current version. For LTS users on version 7.19.x, upgrading to version 7.19.19 LTS is recommended (Atlassian Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management