Get the latest Grey Noise research on Confluence CVE-2022-26134
Summary: Atlassian released a security advisory on 2-Jun-22 for CVE-2022-26134, an unauthenticated remote code execution vulnerability affecting all supported versions of Confluence Server and Data Center, which Volexity discovered over the Memorial Day weekend during incident response and disclosed to Atlassian on May 31st. As of 6-Jun-22 at 7:00 pm UTC, GreyNoise had observed over 850 unique IP addresses attempting to exploit the flaw, with about a third of its sensors hit and over 800 unique IPs in the first week of public proof-of-concept release, putting it in line with Log4J exploitation traffic.
Why it matters: Over 800 unique source IPs in the first week, comparable to Log4J, reflects how easy this is to exploit against a platform where customers store secrets, passwords, and proprietary knowledge.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-44228CVE-2022-26134
- Related
- CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 02, 2022CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021