{"id":"CVE-2024-21683","published":"2024-05-21T23:00:00Z","modified":"2025-05-12T15:22:41Z","title":"This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center…","vendor":"Atlassian","product":"Confluence Data Center","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Confluence Data Center","versions":["8.9.0","8.8.0 to 8.8.1","8.7.1 to 8.7.2","8.6.0 to 8.6.2","8.5.0 to 8.5.8","8.4.0 to 8.4.5","8.3.0 to 8.3.4","8.2.0 to 8.2.3","8.1.0 to 8.1.4","8.0.0 to 8.0.4"]}],"description":{"text":"This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.\n\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. \n\nAtlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html\n\nYou can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives.\n\nThis vulnerability was found internally.","provenance":"source","from":"CVE.org"},"summary":{"text":"Atlassian Confluence Data Center (and Server) contains a code injection flaw, classified as improper control of generation of code, that was introduced in version 5.2. An attacker with network access and low-privilege authenticated credentials can execute arbitrary code on the affected server without any user interaction, with high impact to confidentiality, integrity, and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:19Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.88267,"percentile":0.99768,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-05-23","exploitedFirstSeen":"2024-05-29","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-29&host_type=src&vulnerability=cve-2024-21683","date":"2024-05-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-31&host_type=src&vulnerability=cve-2024-21683","date":"2024-05-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-01&host_type=src&vulnerability=cve-2024-21683","date":"2024-06-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-04&host_type=src&vulnerability=cve-2024-21683","date":"2024-06-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-09&host_type=src&vulnerability=cve-2024-21683","date":"2024-06-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-10&host_type=src&vulnerability=cve-2024-21683","date":"2024-06-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-11&host_type=src&vulnerability=cve-2024-21683","date":"2024-06-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-12&host_type=src&vulnerability=cve-2024-21683","date":"2024-06-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-13&host_type=src&vulnerability=cve-2024-21683","date":"2024-06-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-20&host_type=src&vulnerability=cve-2024-21683","date":"2024-06-20"}],"evidenceTotal":46,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211","tags":[]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-95832","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19299","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19299","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2024-05-23","earliestUrl":"https://github.com/r00t7oo2jm/-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server","repos":[{"name":"W01fh4cker/CVE-2024-21683-RCE","url":"https://github.com/W01fh4cker/CVE-2024-21683-RCE","stars":128,"created":"2024-05-23"},{"name":"absholi7ly/-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server","url":"https://github.com/absholi7ly/-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server","stars":11,"created":"2024-05-24"},{"name":"r00t7oo2jm/-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server","url":"https://github.com/r00t7oo2jm/-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server","stars":2,"created":"2024-05-23"},{"name":"phucrio/CVE-2024-21683-RCE","url":"https://github.com/phucrio/CVE-2024-21683-RCE","stars":1,"created":"2024-05-27"},{"name":"r3db34rdh4x/cve-2024-21683-rce","url":"https://github.com/r3db34rdh4x/cve-2024-21683-rce","stars":0,"created":"2025-11-29"}]},"metasploit":[{"name":"Atlassian Confluence Administrator Code Macro Remote Code Execution","module":"exploit/multi/http/atlassian_confluence_rce_cve_2024_21683","type":"exploit","disclosureDate":"2024-05-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2024_21683.rb"}],"nuclei":[{"id":"CVE-2024-21683","name":"Atlassian Confluence Data Center and Server - Remote Code Execution","severity":"high","path":"http/cves/2024/CVE-2024-21683.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21683.yaml"}],"first":{"date":"2024-05-21","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2024_21683.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-05-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-21683","provenance":"source"},{"date":"2024-05-21","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-05-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2024_21683.rb","provenance":"source"},{"date":"2024-05-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-29&host_type=src&vulnerability=cve-2024-21683","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":65.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 890 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9977"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}