GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2022-26138

Vulnerability from fkie_nvd - Published: 2022-07-20 18:15 - Updated: 2026-06-17 04:34
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
References
security@atlassian.comhttps://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.htmlVendor Advisory
security@atlassian.comhttps://jira.atlassian.com/browse/CONFSERVER-79483Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://jira.atlassian.com/browse/CONFSERVER-79483Issue Tracking, Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26138US Government Resource
Impacted products
Vendor Product Version
atlassian questions_for_confluence 2.7.34
atlassian questions_for_confluence 2.7.35
atlassian questions_for_confluence 3.0.2
atlassian confluence_data_center -
atlassian confluence_server -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Questions For Confluence",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.34"
            },
            {
              "status": "affected",
              "version": "2.7.35"
            },
            {
              "status": "affected",
              "version": "3.0.2"
            }
          ]
        }
      ],
      "source": "security@atlassian.com"
    }
  ],
  "cisaActionDue": "2022-08-19",
  "cisaExploitAdd": "2022-07-29",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:questions_for_confluence:2.7.34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0CE5D29-4DCB-48E5-9F1E-E603E5F6C27E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:questions_for_confluence:2.7.35:*:*:*:*:*:*:*",
              "matchCriteriaId": "60DEB66E-75A9-4C34-9E06-037BE1B263EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:questions_for_confluence:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AD33916-41E6-45BB-A6CC-9ECD4F11A529",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5AB7C4D-ED56-4AB5-BD03-CA807D11C46E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9157ABD-3C98-4742-AE63-EAD7504CDB22",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app."
    },
    {
      "lang": "es",
      "value": "La aplicaci\u00f3n Atlassian Questions For Confluence para Confluence Server y Data Center crea una cuenta de usuario de Confluence en el grupo confluence-users con el nombre de usuario disabledsystemuser y una contrase\u00f1a embebida. Un atacante remoto no autenticado que conozca la contrase\u00f1a embebida podr\u00eda explotar esta situaci\u00f3n para iniciar sesi\u00f3n en Confluence y acceder a todo el contenido accesible para usuarios del grupo confluence-users. Esta cuenta de usuario es creada cuando son instaladas las versiones 2.7.34, 2.7.35 y 3.0.2 de la aplicaci\u00f3n"
    }
  ],
  "id": "CVE-2022-26138",
  "lastModified": "2026-06-17T04:34:46.187",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-26138",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-01-28T21:47:41.648320Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-07-20T18:15:08.617",
  "references": [
    {
      "source": "security@atlassian.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/CONFSERVER-79483"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/CONFSERVER-79483"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26138"
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "security@atlassian.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.