We have taken the following steps to address this issue: Our investigations have not found any evidence of exploitation of Atlassian Cloud.

If your Confluence site is accessed via an domain, it is hosted by Atlassian and is not vulnerable.

The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance.Īll versions of Confluence Server and Data Center prior to the fixed versions listed above are affected by this vulnerability. DescriptionĪtlassian has been made aware of current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server. This is our assessment and you should evaluate its applicability to your own IT environment. Questions For Confluence Security Advisory Īll supported versions of Confluence Server and Data Center are affected.Ĭonfluence Server and Data Center versions after 1.3.0 are affected.Ītlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.Multiple Products Security Advisory - Hazelcast Vulnerable To Remote Code Execution - CVE-2016-10750.Multiple Products Security Advisory - Unrendered unicode bidirectional override characters - CVE-2021-42574.Confluence Community Security Advisory.Confluence Security Overview and Advisories

Confluence versions