Back to CVEs & Disclosures
CRITICAL — CVSS 9.8

Atlassian Confluence OGNL Expression Injection

Unauthenticated OGNL expression injection in Confluence web URI parsing allowing remote code execution via crafted HTTP GET requests.

Status
Vendor Patched
Reported / Disclosed
2022

Impact

  • Execution of arbitrary Java commands inside HTTP URI path expression contexts.
  • No authentication or user privileges required for exploitation.
  • Immediate deployment of web shells and cryptocurrency miners on vulnerable endpoints.

Timeline

  1. JUNE 2, 2022

    Volexity published zero-day incident report and exploitation vectors.

  2. JUNE 3, 2022

    Atlassian released Confluence security hotfixes 7.4.17, 7.13.7, 7.18.1.

aura~
Back to CVEs & Disclosures