Critical severity · published Jun 3, 2022
CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
RansomwareIn wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 2, 2022
Federal remediation dueJun 6, 2022
Ransomware campaign useKnown
Affected products
Which versions
CO
Confluence · Atlassian
next of 1.3.0 before unspecified; before 7.4.17; 7.13.0 before unspecified; before 7.13.7; 7.14.0 before unspecified; before 7.14.3; +8 more · source: vendor, NVD
CS
Confluence Server/Data Center · Atlassian
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26134
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://jira.atlassian.com/browse/CONFSERVER-79016
x_refsource_MISC
http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
x_refsource_MISC
http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html
x_refsource_MISC
http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html
x_refsource_MISC
http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
x_refsource_MISC
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
More from Confluence
9.8
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
9.8
CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
9.8
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
9.8
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
9.8
CVE-2021-26084
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability