CVE-2022-26134
En bref Sévérité CRITICAL 9.8 Exploitation Exploitation connue (CISA KEV) · ajoutée le 2022-06-02 Exploitée selon l'ENISA depuis le 2022-06-02 EPSS EPSS 100.00 % · centile 100 (2026-10-27) État PUBLISHED Publiée 2022-06-03 Mise à jour 2025-10-21 Attribuée par atlassian Statut NVD Analyzed Description In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Scores Version Score Vecteur Évalué par CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 HIGH 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 1.3 < 7.4.17cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.13.0 < 7.13.7cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.14.0 < 7.14.3cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.15.0 < 7.15.2cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.16.0 < 7.16.4cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.17.0 < 7.17.4cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 1.3 < 7.4.17cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.13.0 < 7.13.7cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.14.0 < 7.14.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.15.0 < 7.15.2cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.16.0 < 7.16.4cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.17.0 < 7.17.4cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*Produits affectés Produit Versions Atlassian · Confluence Data Center affected next of 1.3.0 < unspecified ; affected unspecified < 7.4.17 ; affected 7.13.0 < unspecified ; affected unspecified < 7.13.7 ; affected 7.14.0 < unspecified ; affected unspecified < 7.14.3 Atlassian · Confluence Server affected next of 1.3.0 < unspecified ; affected unspecified < 7.4.17 ; affected 7.13.0 < unspecified ; affected unspecified < 7.13.7 ; affected 7.14.0 < unspecified ; affected unspecified < 7.14.3
Références
Sources
