CVE-2021-26072 Server-side request forgery in Confluence Data Center

What is CVE-2021-26072?

CVE-2021-26072 is a medium-severity server-side request forgery vulnerability in Atlassian Confluence Data Center, published on 1 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.

Weakness: CWE-918

Which versions are affected by CVE-2021-26072?

It affects 2 products.

Products include Atlassian Confluence Data Center, Atlassian Confluence Server.

How do I fix CVE-2021-26072?

No fix has been published for CVE-2021-26072 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-26072 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-26072 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Atlassian Confluence Data Center

• CVE-2023-22527 Atlassian Confluence Data Center and Server Template Injection Exploited Critical 10.0
• CVE-2023-22518 Atlassian Confluence Data Center and Server Improper Authorization Exploited Critical 10.0
• CVE-2023-22515 Atlassian Confluence Data Center and Server Broken Access Control Exploited Critical 10.0
• CVE-2022-26134 Atlassian Confluence Server and Data Center Remote Code Execution Exploited Critical 9.8
• CVE-2021-26084 Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Exploited Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-889g-gr2g-424w.