A critical vulnerability in Atlassian Confluence Server and Data Center has been exploited in the wild by multiple threat actors. Organizations should review and implement mitigation guidance until a patch becomes available.

CVE-2022-26134: Zero-Day Vulnerability in Atlassian Confluence Server and Data Center Exploited in the Wild

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

According to its self-reported version number, the Atlassian Confluence running on the remote host is affected by a command injection vulnerability. A remote, unauthenticated attacker can use this to execute arbitrary code.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Atlassian Confluence running on the remote host is affected by a command injection vulnerability. A remote, unauthenticated attacker can use this to execute arbitrary code.

Note this plugin currently only works against 7.14.x and below. This plugin is intended for testing LTS versions of Confluence.

Atlassian Confluence Server and Data Center versions 1.3.x < 7.4.17, 7.13.x < 7.13.7, 7.14.x < 7.14.3, 7.15.x < 7.15.2, 7.16.x < 7.16.4, 7.17.x < 7.17.4 and 7.18.x < 7.18.1 suffer from an OGNL injection vulnerability by crafting a specific URL, allowing an unauthenticated attacker to perform a remote code execution on the target application.

ID	Name	Product	Family	Severity
169509	Atlassian Confluence Command Injection (CONFSERVER-79016)	Nessus	Misc.	critical
162175	Atlassian Confluence Command Injection (CVE-2022-26134) (Direct Check)	Nessus	CGI abuses	critical
113248	Atlassian Confluence Namespace OGNL Injection	Web App Scanning	Component Vulnerability	critical
161808	Atlassian Confluence Command Injection (CVE-2022-26134)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2022-26134

critical

Tenable Plugins

critical

critical

critical

critical