QID 150556

Date Published: 2022-08-04

QID 150556: Atlassian Confluence Server and Data Center : Questions for Confluence App - Hardcoded Credentials (CVE-2022-26138)

Confluence is a team collaboration software. Written in Java and mainly used in corporate environments, it is developed and marketed by Atlassian.

Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password.

Affected versions:
Questions for Confluence Version 2.7.34
Questions for Confluence Version 2.7.35
Questions for Confluence Version 3.0.2

QID Detection Logic (Unauthenticated) :
This QID sends a specially-crafted HTTP POST request with hardcoded credentials to log into Confluence application and retrieve disabledsystemuser account profile page to confirm the vulnerability.

Successful exploitation of this vulnerability would allow an remote attacker with knowledge of the hardcoded credentials to log into Confluence application and access any pages the confluence-users group has access to.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as Critical - 9 severity.

Solution

Customers are advised to upgrade to Questions for Confluence App Versions 2.7.x >= 2.7.38 (compatible with Confluence 6.13.18 through 7.16.2) and Versions >= 3.0.5 (compatible with Confluence 7.16.3 and later) to remediate this vulnerability, Or Disable or delete the disabledsystemuser account. For more information regarding this vulnerability please refer to Questions For Confluence Security Advisory.

Vendor References

Questions For Confluence Security Advisory - confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html

CVEs related to QID 150556

CVE-2022-26138 |

Software Advisories

Advisory ID	Software	Component	Link
Questions For Confluence Security Advisory			confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].