Skip to content
COOEY

EXPOSURES › CVE-2022-26138

CVE-2022-26138

HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2022-07-29 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2022-26138 ↗
⌖ EXPLOITED IN THE WILD SHAME 50/100 exploited-in-wild

An Atlassian Confluence app shipped with hardcoded credentials, allowing unauthorized access to Confluence data and functionality.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED
Atlassian · vendorConfluence · product
DESCRIPTION

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.