Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2022-26134

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

Atlassian Confluence Server and Data Center are affected by this vulnerability, which lets an unauthenticated attacker run arbitrary code on the server. Successful exploitation would give an attacker full control over the affected Confluence instance and the data it holds.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Timeline

  1. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  2. CVE published
  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Atlassian Confluence Data Center

    From next of 1.3.0 · fixed in unspecified; From unspecified · fixed in 7.4.17; From 7.13.0 · fixed in unspecified; From unspecified · fixed in 7.13.7; From 7.14.0 · fixed in unspecified; From unspecified · fixed in 7.14.3; From 7.15.0 · fixed in unspecified; From unspecified · fixed in 7.15.2; From 7.16.0 · fixed in unspecified; From unspecified · fixed in 7.16.4; From 7.17.0 · fixed in unspecified; From unspecified · fixed in 7.17.4; From 7.18.0 · fixed in unspecified; From unspecified · fixed in 7.18.1

  • Atlassian Confluence Server

    From next of 1.3.0 · fixed in unspecified; From unspecified · fixed in 7.4.17; From 7.13.0 · fixed in unspecified; From unspecified · fixed in 7.13.7; From 7.14.0 · fixed in unspecified; From unspecified · fixed in 7.14.3; From 7.15.0 · fixed in unspecified; From unspecified · fixed in 7.15.2; From 7.16.0 · fixed in unspecified; From unspecified · fixed in 7.16.4; From 7.17.0 · fixed in unspecified; From unspecified · fixed in 7.17.4; From 7.18.0 · fixed in unspecified; From unspecified · fixed in 7.18.1

References 6

jira.atlassian.com

packetstormsecurity.com

confluence.atlassian.com

FAQ

Questions about CVE-2022-26134

What does this mean?

An OGNL injection flaw lets an attacker who has no login send crafted input that makes the server run arbitrary code. The advisory describes the result as full code execution on the Confluence instance.Source: jira.atlassian.com, confluence.atlassian.com

Am I affected, and how do I check?

Affected are Confluence Server and Data Center releases from 1.3.0 before 7.4.17, 7.13.0 before 7.13.7, 7.14.0 before 7.14.3, 7.15.0 before 7.15.2, 7.16.0 before 7.16.4, 7.17.0 before 7.17.4, and 7.18.0 before 7.18.1. Check your installed version in the Confluence administration console or the about page to compare it against these ranges.Source: jira.atlassian.com, confluence.atlassian.com

What should I do about it?

Upgrade to a fixed release: 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 or 7.18.1, matching your release line. If you cannot upgrade right away, the advisory's workaround replaces the xwork and webwork JARs and CachedConfigurationProvider.class files as described for your version range.Source: jira.atlassian.com, confluence.atlassian.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-06-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data