Atlassian Releases Patches to Fix Critical Confluence Flaw
Atlassian has disclosed a new critical flaw in its Confluence Server and Data Center products. The company explained in its security advisory that the vulnerability (CVE-2022-26138) lets unauthorized users use hardcoded credentials to get full access to Confluence.
According to Atlassian, the flaw exists in its Questions for Confluence app. It is designed to help employees share knowledge and connect with their co-workers via questions and answers. The app provides searching, filtering, and sorting options to make it easier for users to find relevant information. It is currently deployed on more than 8,000 Confluence servers worldwide.
Essentially, the Questions for Confluence app creates a default user account with a hard-coded user name and password “disabledsystemuser.” This approach helps to facilitate data migrations from the app to the cloud. However, the hard-coded password could be abused by hackers to log in to vulnerable servers.
“The disabledsystemuser account is created with a hardcoded password and is added to the confluence-users group, which allows viewing and editing all non-restricted pages within Confluence by default. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access any pages the confluence-users group has access to,” the company explained.
Atlassian recommends updating to a patched version
Atlassian has confirmed that the problem affects all companies using the Questions for Confluence app version 2.7.x and 3.0.x. However, it doesn’t impact Confluence Cloud customers.
The company recommends that organizations should install the latest Questions for Confluence update (versions 2.7.x >= 2.7.38 or versions higher than 3.0.5). Alternatively, customers can disable or delete the “disabledsystemuser” account to mitigate the issue.
Atlassian has acknowledged that attackers have yet to exploit the security flaw. That said, it has encouraged IT admins to check for the last authentication time for the specific account by following this step-by-step guide. This should help them find any exploitation attempts on vulnerable servers.
More in Security
How to Enable Windows 11 Config Lock on Secured-Core PCs
Dec 2, 2022 | Dean Ellerby
Microsoft Defender Vulnerability Management Now Supports Firmware Assessments
Nov 29, 2022 | Rabia Noureen
Microsoft Entra Workload Identities Service is Now Generally Available
Nov 29, 2022 | Rabia Noureen
Microsoft Authenticator to Enable Number Matching Security Feature by Default in February 2023
Nov 21, 2022 | Rabia Noureen
Microsoft Defender for Endpoint Adds Network Protection on iOS and Android
Nov 11, 2022 | Rabia Noureen
What is a Software-Defined Perimeter?￼
Nov 11, 2022 | Sukesh Mudrakola
Most popular on petri