Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 29/07/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| questions for confluence | = 2.7.34= 2.7.35= 3.0.2 |
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free