- 157/2022
- High
Atlassian has resealed a security fix to mitigate a critical security vulnerability that uses hard-coded credentials affecting Confluence Server and Confluence Data Center.
The Confluence user account with the username “disabledsystemuser” is created when the Questions for Confluence app is enabled on Confluence Server or Data Center. This account is intended to aid administrators in migrating data from the app to Confluence Cloud. However, The remote unauthenticated attacker with knowledge of the hard-coded password could exploit this to log into Confluence and access any pages the confluence-users group has access to.
Atlassian Confluence Vulnerability (CVE-2022-26138)
- CVSS: 8.6
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Gain Access
- Remediation Level: Official Fix
Vulnerabilities
CVE-2022-26138
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.
https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-
2022-07-20-1142446709.html