Security readout for executives and security teams
Plain-English summary
This issue affects Atlassian Confluence Server and Data Center installations on Windows. A local attacker could abuse a DLL hijacking flaw in the Confluence installer to gain higher privileges on the host. The risk is serious for Windows-hosted Confluence servers, but the provided sources do not show remote exploitation or active exploitation.
Executive priority
Treat as a high-priority remediation item for Windows-hosted Confluence. It is not described as internet-runnable, but successful exploitation could give an attacker broad control of the server.
Technical view
CVE-2021-43940 is a CWE-427 DLL hijacking vulnerability in the Confluence installer. Sources limit impact to Confluence Server and Data Center on Windows, before 7.4.10 and 7.5.0 before 7.12.3. CVSS 3.1 is 7.8, with local attack vector, low complexity, user interaction required, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is likely limited to organizations running affected Confluence Server or Data Center versions on Windows. Linux deployments and Atlassian Cloud are not identified as affected in the provided sources.
Exploitation context
The bundle does not identify public exploit use or CISA KEV listing. The described path is local privilege escalation through the installer, so practical risk depends on local host access and installer execution context.
Researcher notes
Evidence is narrow and vendor-specific. The key constraints are Windows-only, Confluence Server/Data Center only, installer-based DLL hijacking, local attack vector, and no KEV signal in the bundle. Do not expand scope without vendor evidence.
Mitigation direction
- Upgrade affected Windows Confluence Server or Data Center deployments to fixed versions named in the CVE.
- For 7.4.x, verify Confluence is at least 7.4.10.
- For 7.5.0 through 7.12.x, verify Confluence is at least 7.12.3.
- Review Atlassian issue CONFSERVER-66550 for any current vendor guidance.
- Restrict local interactive access to Windows Confluence hosts to approved administrators.
Validation and detection
- Inventory Confluence Server and Data Center instances and identify operating system platform.
- Check installed Confluence versions against the affected version ranges.
- Confirm Windows instances are upgraded to 7.4.10 or 7.12.3 or later as applicable.
- Review endpoint and admin logs for unexpected local installer activity.
- Document non-Windows instances as out of scope based on the provided sources.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-427: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-43940 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://jira.atlassian.com/browse/CONFSERVER-66550CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Search Path Element
Uncontrolled Search Path Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.