CVEvulnerability

CVE-2022-26138

9.8 CRITICAL Known exploited Published 2022-07-20 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability — Atlassian Confluence

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

Added to KEV: 2022-07-29
Remediation due: 2022-08-19
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html; https://nvd.nist.gov/vuln/detail/CVE-2022-26138

Status: Analyzed
Published: 2022-07-20
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-798

Description

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.

Affected configurations

• atlassian questions for confluence 2.7.34 • atlassian questions for confluence 2.7.35 • atlassian questions for confluence 3.0.2

Weakness · CWE (1)

CWE-798 Use of Hard-coded Credentials weakness

References