CVE-2022-26138

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 98,2%

Kerentanan Use of Hard-coded Credentials pada atlassian questions for confluence. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 29 Juli 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.

Rincian

Terbit di NVD

20 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

98,2% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Masuk KEV

29 Juli 2022

Tenggat CISA

19 Agustus 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html advisory vendor
• https://jira.atlassian.com/browse/CONFSERVER-79483 issue tracking · patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26138 pemerintah AS