Critical · published July 20, 2022
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A hardcoded username and password combo turns your Confluence site into an open door! An unauthenticated attacker could stroll right in and access all the content meant for your users. 🔥 Imagine a hotel where guests can enter any room because the manager left all the doors unlocked with a single key hanging at the reception. That's what this vulnerability allows - a recipe for disaster! An attacker with knowledge of the hardcoded password can log into Confluence as the 'disabledsystemuser,' gaining access to everything in the confluence-users group. This is absolutely devastating as sensitive information could leak and the integrity of your content could be compromised!
Imagine a hotel where guests can enter any room because the manager left all the doors unlocked with a single key hanging at the reception. That's what this vulnerability allows - a recipe for disaster! This flaw arises in the Atlassian Questions For Confluence app for versions 2.7.34, 2.7.35, and 3.0.2, where a hardcoded account is created during installation that can be exploited by remote attackers to gain unauthorized access.
An attacker with knowledge of the hardcoded password can log into Confluence as the 'disabledsystemuser,' gaining access to everything in the confluence-users group. This is absolutely devastating as sensitive information could leak and the integrity of your content could be compromised! Immediately update your Atlassian Questions For Confluence app to a version above 3.0.2. Disable or remove the 'disabledsystemuser' account if it exists, and consider implementing additional access controls for your Confluence instance. Stay vigilant! You’ve got this! Follow these steps, and you’ll secure your Confluence in no time! 🛡️