The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users g
Affects Questions For Confluence app versions 2.7.34, 2.7.35, and 3.0.2 on Confluence Server or Data Center when the app is enabled. Fixed in later app versions.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Questions For Confluence app for Atlassian Confluence Server and Data Center is affected. An attacker who knows a built-in hardcoded password could log in remotely without authentication and view any content that Confluence users in the standard user group can access.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Atlassian Questions For Confluence
2.7.34, 2.7.35, 3.0.2
References 2
jira.atlassian.com
confluence.atlassian.com
Questions about CVE-2022-26138
What does this mean?
The app creates a user account named disabledsystemuser with a hardcoded password. Anyone who knows that password could log into Confluence and reach any pages the confluence-users group can access.Source: confluence.atlassian.com
Am I affected, and how do I check?
Installed versions 2.7.34, 2.7.35, and 3.0.2 of the Questions for Confluence app are listed as creating the account, on Confluence Server or Data Center where the app is enabled. Check the installed app version and whether the app is enabled in Confluence's app management screens.Source: confluence.atlassian.com
What should I do about it?
Upgrade the Questions for Confluence app to a fixed version, which stops creating the disabledsystemuser account.Source: confluence.atlassian.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-07-29, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
Disable or delete the disabledsystemuser account in Confluence until the app is upgraded.Source: confluence.atlassian.com