Description
The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Confluence Server | unspecified – < 5.8.6 | 5.8.6 |
| Atlassian | Confluence Data Center | unspecified – < 5.8.6 | 5.8.6 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Atlassian Confluence < 5.8.6 - Server-Side Request Forgery http/cves/2021/CVE-2021-26072.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.