Atlassian · Confluence Server/Data Center
The flaw is an OGNL injection vulnerability in Atlassian Confluence Server and Data Center, in affected versions from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1. An unauthenticated attacker with network access to a vulnerable instance can execute arbitrary code on the server, with no authentication or user interaction required and no special configuration needed.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
First seen exploited 3 months before it was disclosed. Public exploit code (PoC-in-GitHub) was available 3 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This vulnerability is exploited by placing a payload in the URI of an HTTP request to a public-facing server.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2022-26134 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Recommendations that help organizations protect against exploitation of multiple vulnerabilities, including CVE-2022-26134, can be found in the recommendations section of this report.
3 passages name itOriginal (opens in a new tab) ↗
…the Wire is a proof of concept exploit for CVE-2022-26134, an OGNL injection vulnerability…
4 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.