CVE-2022-26138

Produto

Atlassian / Confluence

Vulnerabilidade

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Adicionado ao KEV

29 de jul. de 2022

Corrigir até

19 de ago. de 2022

Uso conhecido em ransomware

Não

Descrição resumida

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

Ação necessária

Apply updates per vendor instructions.

Notas

https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html; https://nvd.nist.gov/vuln/detail/CVE-2022-26138