Vulnerability Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Confluence Data Center | >= 1.3, < 7.4.17 |
| Atlassian | Confluence Server | >= 1.3, < 7.4.17 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-CodExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-ConfThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-CThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-ExploitThird Party AdvisoryVDB Entry
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-113Vendor Advisory
- https://jira.atlassian.com/browse/CONFSERVER-79016Issue TrackingPatchVendor Advisory
- http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-CodExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-ConfThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-CThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-ExploitThird Party AdvisoryVDB Entry
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-113Vendor Advisory
- https://jira.atlassian.com/browse/CONFSERVER-79016Issue TrackingPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-US Government Resource
FAQ
What is CVE-2022-26134?
CVE-2022-26134 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data ...
How severe is CVE-2022-26134?
CVE-2022-26134 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-26134?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Confluence Data Center, Atlassian Confluence Server.