CVE-2022-26134: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
Other sources
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Atlassian Confluence Server and Data Centerto a version that resolves this vulnerability.Fixed in 7.4.17 - Upgrade
Upgrade
Atlassian Confluence Server and Data Centerto a version that resolves this vulnerability.Fixed in 7.13.7 - Upgrade
Upgrade
Atlassian Confluence Server and Data Centerto a version that resolves this vulnerability.Fixed in 7.14.3 - Upgrade
Upgrade
Atlassian Confluence Server and Data Centerto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
Atlassian Confluence Server and Data Centerto a version that resolves this vulnerability.Fixed in 7.16.4 - Upgrade
Upgrade
Atlassian Confluence Server and Data Centerto a version that resolves this vulnerability.Fixed in 7.17.4 - Upgrade
Upgrade
Atlassian Confluence Server and Data Centerto a version that resolves this vulnerability.Fixed in 7.18.1 - Remove
Remove
Atlassian Confluence Server and Data Centerfrom your environment.Remove the affected products by the due date (remove/uninstall affected Confluence Server or Data Center instances) if you choose not to apply updates.
- Compensating control
Immediately block all internet traffic to and from affected products (Atlassian Confluence Server / Data Center) — restrict ingress and egress at network perimeter/firewall for any Confluence Server or Data Center instances.
- Operational
Once the update is successfully deployed, reassess and, if appropriate, remove or relax the internet blocking rules that were applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26134?
The severity of CVE-2022-26134 is critical with a CVSS score of 9.8.
How does CVE-2022-26134 impact Atlassian Confluence Server and Data Center?
CVE-2022-26134 allows an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
Which versions of Confluence Server and Data Center are affected by CVE-2022-26134?
The affected versions of Confluence Server and Data Center range from 1.3.0 to 7.4.17, 7.13.0 to 7.13.7, 7.14.0 to 7.14.3, 7.15.0 to 7.15.2, 7.16.0 to 7.16.4, 7.17.0 to 7.17.4, and 7.18.0.
How do I fix CVE-2022-26134?
To fix CVE-2022-26134, it is recommended to upgrade to a fixed version of Atlassian Confluence Server or Data Center as mentioned in the Atlassian security advisory.
Where can I find more information about CVE-2022-26134?
You can find more information about CVE-2022-26134 in the provided references: [link1](http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html), [link2](http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html), [link3](http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html).