Confluence OGNL Injection (CVE-2021-26084) | Threat SnapShot

Описание: As part of our series on the CISA 2021 Top Routinely Exploited Vulnerabilities (https://www.cisa.gov/uscert/ncas/aler..., this week we're diving into an unauthenticated code execution vulnerability in Atlassian Confluence Server. Confluence Server and Data Center versions before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5 are affected by this vulnerability. As always, we'll demonstrate what the attack looks like, as well as discuss mitigation and detection strategies for this threat.