Main
Vulnerability Database
Exploits
ID:7056 - Exploit for Missing Authorization in Atlassian Confluence Server - CVE-2021-26085
ID:7056 - Exploit for Missing Authorization in Atlassian Confluence Server - CVE-2021-26085
Published: November 25, 2021
Vulnerability identifier: #VU57077
Vulnerability risk: Medium
CVE-ID: CVE-2021-26085
CWE-ID: CWE-862
Exploitation vector: Remote access
Vulnerable software:
Atlassian Confluence Server
Atlassian Confluence Server
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to missing authorization in the /s/ endpoint. A remote non-authenticated attacker can send a specially crafted HTTP request to the application and view contents of arbitrary files on the system.
Remediation
Install updates from vendor's website.