CVE-2022-26138

CVE-2022-26138 affects Atlassian’s Questions for Confluence app on Confluence Server/Data Center. The vulnerability arises because the app creates a Confluence user account named disabledsystemuser in the confluence-users group with a hardcoded password, and the account is not disabled by default...

CVE-2018-13394

CVE-2018-13394 affects Atlassian Confluence Questions prior to 2.6.6. The vulnerability is a CSRF in the acceptAnswer resource that lets an attacker, via a remote request, convert a comment into an accepted answer. The fixed version is bundled in Confluence 6.9.0 (and the Questions add-on should ...

CVE-2018-13393

The CVE-2018-13393 vulnerability concerns Atlassian Confluence Questions prior to version 2.6.6. The issue is a CSRF flaw in the convertCommentToAnswer resource that could let a remote attacker modify a user’s comment into an answer. Atlassian notes a fixed version in Confluence 6.9.0, with the v...