CVE-2022-26138

2022-07-2000:00:00

CWE-798

atlassian

www.cve.org

9.6 High

AI Score

Confidence

High

0.972 High

EPSS

Percentile

99.9%

JSON

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.

CNA Affected

[
  {
    "product": "Questions For Confluence",
    "vendor": "Atlassian",
    "versions": [
      {
        "status": "affected",
        "version": "2.7.34"
      },
      {
        "status": "affected",
        "version": "2.7.35"
      },
      {
        "status": "affected",
        "version": "3.0.2"
      }
    ]
  }
]