⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.. Due date: 2022-06-06.
CVE-2022-26134 — Expression Language Injection in Atlassian Confluence Data Center
Severity
9.8CRITICALNVD
EPSS
94.4%
top 0.02%
CISA KEV
KEVRansomware
Added 2022-06-02
Due 2022-06-06
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
KEV addedJun 2
PublishedJun 3
KEV dueJun 6
Latest updateJun 2
CISA Required Action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Description
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages4 packages
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-653m-wpjp-54c4: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to exec↗2022-06-04
CVEList▶
CVE-2022-26134: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to exec↗2022-06-03
💥Exploits & PoCs
2Nuclei▶
Confluence - Remote Code Execution