CVE-2022-26138
Description
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
NVD
Severity: CRITICAL
CVE ID: CVE-2022-26138
CVSS Score: 9.8
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Proof Of Concept
Nuclei Templates for CVE-2022-26138
Refrence: Project Discovery GitHub
alcaparra
Atlassian Questions Hardcoded Password (CVE-2022-26138)
Refrence: GitHub
Vulnmachines
Atlassian Confluence Server and Data Center: CVE-2022-26138
Refrence: GitHub
z92g
Confluence Hardcoded Password POC
Refrence: GitHub
shavchen
Refrence: GitHub