by Kastro CVE-2022-26138
Atlassian Questions For Confluence — Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
Description · from the CVE record
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Affected
ProductAffectedFixed inSource
Questions For Confluence2.7.34–CNA
Questions For Confluence2.7.35–CNA
Questions For Confluence3.0.2–CNA
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total