CVE-2022-26138 Atlassian Questions For Confluence App Hard-coded Credentials
Remote attackers can log in using hardcoded credentials to access Confluence content via a disabled system user account.
- Exploited in the wild
- Since 29 Jul 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-26138?
CVE-2022-26138 is a critical vulnerability in Atlassian Questions For Confluence, published on 20 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Weakness: CWE-798
Which versions are affected by CVE-2022-26138?
It affects 1 product.
Products include Atlassian Questions for Confluence.
How do I fix CVE-2022-26138?
No fix has been published for CVE-2022-26138 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 19 Aug 2022.
Is CVE-2022-26138 being exploited?
Yes. Attackers have exploited CVE-2022-26138 in the wild since at least 29 Jul 2022.
Public exploit code: 1 Nuclei template and 4 proofs of concept on GitHub.
Other vulnerabilities in Atlassian Questions For Confluence
Sources
Also known as GHSA-23xf-wg9r-49fr.