critical9.8Known exploited
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-07-29. Federal due date: 2022-08-19.
Apply updates per vendor instructions.
Impact
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Atlassian | Questions For Confluence | Versions 2.7.34, 2.7.35, 3.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
- https://jira.atlassian.com/browse/CONFSERVER-79483
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html
- https://jira.atlassian.com/browse/CONFSERVER-79483
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26138