Advisory 2022-1161 - Atlassian Confluence: Vulnerability allows code execution

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2022-1161

Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.

5	Attack probability high
4	Potential damage medium-high

Date: 2022-06-03
Release: 2022-06-07 UPDATE

Operating System

Linux
UNIX
Windows

Software

Atlassian Confluence

Attack

A remote anonymous attacker can exploit a vulnerability in Atlassian Confluence in order to execute arbitrary code.

Description

Confluence is a commercial wiki software.

CVE-2022-26134

There is a not further described vulnerability in all versions of Atlassian Confluence Server and Confluence Data Center. A remote anonymous attacker can exploit this to execute arbitrary code (e.g. malware).

CVSSv2 Base Score: 7.5 / Temporal Score: 7.1
AV:N/AC:L/AU:N/C:P/I:P/A:P/E:H/RL:W/RC:ND
CVSSv3.1 Base Score: 10.0 / Temporal Score: 9.7
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:W/RC:X

Exploit code taking advantage of the vulnerability CVE-2022-26134 is available on the Internet. The vulnerability is already being actively exploited in numerous attacks.

Recommendation

Atlassian describes complementary security measures, such as the use of web application firewalls. Alternatively, it is advised to disconnect existing installations from the Internet or disable them temporarily. For further information please consult the vendor's advisory.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

At present no update or patch for the removal of this vulnerability is available.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

UPDATE 2022-06-07

Atlassian provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://jira.atlassian.com/browse/CONFSERVER-79000

Information

Confluence Security Advisory 2022-06-02 dated 2022-06-02
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

Volexity Blog: Zero-Day Exploitation of Atlassian Confluence dated 2022-06-02
https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/

UPDATE 2022-06-07

Atlassian Security Advisory CONFSERVER-79000 dated 2022-06-03
https://jira.atlassian.com/browse/CONFSERVER-79000

References

ATLASSIAN:CONFSERVER-79000
CVE:CVE-2022-26134

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.