CVE-2021-43940

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

VendorProductVersions
AtlassianConfluence Server>= unspecified, < 7.4.10; >= 7.5.0, < unspecified; >= unspecified, < 7.12.3
AtlassianConfluence Data Center>= unspecified, < 7.4.10; >= 7.5.0, < unspecified; >= unspecified, < 7.12.3
atlassianconfluence_data_center< 7.4.10; >= 7.5.0, < 7.12.3
atlassianconfluence_server< 7.4.10; >= 7.5.0, < 7.12.3

References

Timeline

Published
Feb 15, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-439416.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPagCVE-2021-439426.1Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected CroCVE-2021-439434.8Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrCVE-2021-439447.2This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. AfCVE-2021-439454.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrarCVE-2021-439466.5Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscrCVE-2021-439477.2Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code viCVE-2021-439484.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of privCVE-2021-439494.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects vCVE-2021-43956.5The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includinCVE-2021-439504.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source conCVE-2021-439514.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import con
CVE-2021-43940: High severity, CVSS 7.8 | Vulnix