← Back

CVE-2021-26085

nvd nistnuclei
Published: Aug 3, 2021Modified: Oct 24, 2025CISA KEV

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

Affected (4)

Atlassian
2 products
Confluence Data Center
Confluence Server
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Atlassian
Confluence Data Center
Before 7.4.10
Confluence Data Center
From 7.5.0 to 7.12.3
Atlassian
Confluence Server
Before 7.4.10
Confluence Server
From 7.5.0 to 7.12.3

Related CWEs

CWE-425
Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (5)

Source: security@atlassian.com
ExploitThird Party AdvisoryVDB Entry
Source: security@atlassian.com
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.