rewindex

RewindexCVEsConfluence

CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

Critical · CVSS 9.8 (CVSS 3.1)KEV known exploitedEPSS 100.0%, 100th percentilePublished Updated Assigner: atlassian

In CISA’s Known Exploited Vulnerabilities catalog: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability.

Added , federal remediation due . Known ransomware use: Known.

Required action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tracked companies

Confluence

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Atlassian: Confluence Data CenterAtlassian: Confluence Server

References

All CVEsMarkdownJSON