CVE-2022-26134
Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
How to fix
Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
CISA due date: Jun 6, 2022- atlassian confluence_data_center7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 or later
- atlassian confluence_server7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian confluence_data_center | 1.3 ≤ v < 7.4.17, 7.13.0 ≤ v < 7.13.7, 7.14.0 ≤ v < 7.14.3, 7.15.0 ≤ v < 7.15.2, 7.16.0 ≤ v < 7.16.4, 7.17.0 ≤ v < 7.17.4, 7.18.0 | 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 |
| atlassian confluence_server | 1.3 ≤ v < 7.4.17, 7.13.0 ≤ v < 7.13.7, 7.14.0 ≤ v < 7.14.3, 7.15.0 ≤ v < 7.15.2, 7.16.0 ≤ v < 7.16.4, 7.17.0 ≤ v < 7.17.4, 7.18.0 | 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.