CVE-2024-21678 | Confluence Data Center - Web Application Operational Intel

Executive Risk Summary

"A stored XSS vulnerability in Confluence Data Center allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser, potentially leading to confidentiality breaches. The vulnerability can be exploited without user interaction and has a CVSS score of 8.5."

Anticipated Attack Path

1. An attacker authenticates to the Confluence Data Center instance
2. The attacker injects malicious HTML or JavaScript code into a Confluence page
3. A victim views the compromised page, executing the attacker's code

Am I Vulnerable?

Verify Confluence Data Center version and upgrade to a fixed version
Monitor user activity for suspicious behavior
Implement web application firewall rules to detect and prevent XSS attacks

Operational Audit Arsenal

Target Type Web Application

Target Asset confluence

Standard Path https://confluence.atlassian.com/

Manual Verification Required

This is a non-Windows asset (Atlassian). Use the target asset details and official path provided above to verify your current version against the official vendor advisories listed below.