Atlassian Confluence: Questions for Confluence App Hardcoded Credentials Vulnerability (CVE-2022-26138) | Qualys
Summary: The Questions for Confluence app creates a user account with hardcoded credentials - username disabledsystemuser and password disabled1system1user6708 - stored in the default.properties file inside the confluence-questions-X.X.X.jar file, and adds that account to the confluence-users group, which can view and edit all non-restricted pages by default. Atlassian rated CVE-2022-26138 critical and said it is being exploited in the wild, and uninstalling the app does not remove the disabledsystemuser account.
Bottom line: Anyone who knows a password published in a plugin jar file can log into Confluence and read or edit every non-restricted page in the confluence-users group - and the account survives uninstalling the app, so it can sit in instances where Questions for Confluence was removed long ago.
Read the original at Qualys Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2022-26134CVE-2022-26138
- Related
- 2022 0-day In-the-Wild Exploitation…so far Cyber Risks ·CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability Known Exploited Vulnerabilities · Jul 29, 2022CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 02, 2022