Severity
Medium
Analysis Summary
CVE-2022-26136 CVSS:5.3
Multiple Atlassian products could allow a remote attacker to bypass security restrictions. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass Servlet Filters.
CVE-2022-26138 CVSS:8.6
Atlassian Confluence Server and Data Center contains default hardcoded passwords. A remote attacker could exploit this vulnerability to log into Confluence and access all content accessible to users in the confluence-users group.
Impact
- Security Bypass
- Unauthorized Access
Indicators Of Compromise
CVE
- CVE-2022-26136
- CVE-2022-26138
Affected Vendors
Atlassian
Affected Products
- Atlassian Bamboo 8.0.8
- Atlassian Bamboo 8.2.3
- Atlassian Bamboo 8.1.7
- Atlassian Bamboo 7.2.8
- Atlassian Confluence Server and Data Center 7.14.2
- Atlassian Confluence Server and Data Center 7.15.1
- Atlassian Confluence Server and Data Center 7.16.3
- Atlassian Confluence Server and Data Center 7.4.16
- Atlassian Confluence Server and Data Center 7.13.6
- Atlassian Confluence Server and Data Center 7.18.0
- Atlassian Confluence Server and Data Center 7.17.3
- Atlassian Crucible 4.8.9
- Atlassian Crowd 4.3.7
- Atlassian Crowd 4.4.1
- Atlassian Crowd 5.0.0
- Atlassian Fisheye 4.8.9
- Atlassian Jira Server and Data Center 8.13.21
- Atlassian Jira Server and Data Center 8.20.9
- Atlassian Jira Server and Data Center 8.22.3
- Atlassian Jira Service Management Server and Data Center 4.20.9
- Atlassian Jira Service Management Server and Data Center 4.13.21
- Atlassian Jira Service Management Server and Data Center 4.22.3
Remediation
Refer to Atlassian Security Advisory for patch, upgrade or suggested workaround information.