CVE-2024-21683

HIGH

Published May 21, 2024 Modified May 12, 2025 CWE-94

Description

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally.

Is your site exposed to CVE-2024-21683?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-94 CWE-94

Affected Products

Vendor	Product	Versions
atlassian	confluence_data_center	7.19.0 — 7.19.24
atlassian	confluence_data_center	7.20.0 — 7.20.3
atlassian	confluence_data_center	8.0.0 — 8.0.4
atlassian	confluence_data_center	8.1.0 — 8.1.4
atlassian	confluence_data_center	8.2.0 — 8.2.3
atlassian	confluence_data_center	8.3.0 — 8.3.4
atlassian	confluence_data_center	8.4.0 — 8.4.5
atlassian	confluence_data_center	8.5.0 — 8.5.11
atlassian	confluence_data_center	8.6.0 — 8.6.2
atlassian	confluence_data_center	8.9.0 — 8.9.3
atlassian	confluence_data_center	All
atlassian	confluence_data_center	All
atlassian	confluence_data_center	All
atlassian	confluence_data_center	All
atlassian	confluence_server	7.19.0 — 7.19.24
atlassian	confluence_server	7.20.0 — 7.20.3
atlassian	confluence_server	8.0.0 — 8.0.4
atlassian	confluence_server	8.1.0 — 8.1.4
atlassian	confluence_server	8.2.0 — 8.2.3
atlassian	confluence_server	8.3.0 — 8.3.4
atlassian	confluence_server	8.4.0 — 8.4.5
atlassian	confluence_server	8.5.0 — 8.5.11
atlassian	confluence_server	8.6.0 — 8.6.2
atlassian	confluence_server	8.9.0 — 8.9.2
atlassian	confluence_server	All
atlassian	confluence_server	All
atlassian	confluence_server	All
atlassian	confluence_server	All
atlassian	fisheye	4.8.0 — 4.8.15
atlassian	crucible	4.8.0 — 4.8.15
atlassian	jira_data_center	9.4.0 — 9.4.21
atlassian	jira_data_center	9.12.0 — 9.12.8
atlassian	jira_server	9.4.0 — 9.4.21
atlassian	jira_server	9.12.0 — 9.12.8
atlassian	jira_service_management	5.4.0 — 5.4.21
atlassian	jira_service_management	5.12.0 — 5.12.8
atlassian	jira_service_management	5.15.2 — 5.16.0
atlassian	jira_service_management	5.4.0 — 5.4.21
atlassian	jira_service_management	5.12.0 — 5.12.8
atlassian	jira_service_management	All

References

Advisories & Patches

https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211

Other References

https://jira.atlassian.com/browse/CONFSERVER-95832

Frequently Asked Questions

What is CVE-2024-21683? +

How severe is CVE-2024-21683? +

CVE-2024-21683 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-21683? +

CVE-2024-21683 affects products from atlassian, specifically: confluence_data_center, confluence_server, crucible, fisheye, jira_data_center, jira_server, jira_service_management. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-21683? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-22136

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including …

CVE-2025-24482

A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default …

CVE-2026-55576

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pull_request.title into a …

CVE-2026-59859

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, …

CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and …

CVE-2026-42890

Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE …

Quick Facts

CVSS Score: 8.8
Severity: HIGH
Published: May 21, 2024

Scan for this vulnerability

Check if your website or infrastructure is affected by CVE-2024-21683.

Website Scan Port Scan

Browse CVEs

Critical High CISA KEV ! Most likely exploited →