{"uuid": "88a35f8a-6034-46b7-a8cd-1f1cf57c04a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26137", "type": "seen", "source": "https://t.me/hacking_Attack/62491", "content": "Black Hat Ethical Hacking\nAtlassian patches batch of critical hardcode vulnerability\n\nAtlassian patches batch of critical hardcode vulnerabilityPost Views: 21 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nAtlassian has addressed a hardcoded credential vulnerability in Questions for Confluence and servlet filter bypasses in multiple other products.\n\nThe Australian\u00a0vendor of software development and collaboration tools issued security advisories with instructions for applying updates and mitigations yesterday (July 20).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Servlet filter bypassesThe servlet filter bypass flaws affect multiple versions of Bamboo Server and Data Center, Bitbucket Server and Data Center, Confluence Server and Data Center, Crowd Server and Data Center, Fisheye and Crucible, Jira Server and Data Center, and Jira Service Management Server and Data Center.\n\nFixes have been deployed to Atlassian Cloud sites.\n\nServlet filters intercept and process HTTP requests before a client request is sent to a backend resource, and from a backend resource before they\u2019re sent to a client.\n\nA vulnerability tracked as CVE-2022-26136 allowed an unauthenticated attacker to bypass servlet filters used by as-yet unspecified first- and third-party apps.\n\nThe impact depends on which filters an app uses and how they are used, said Atlassian.\n\n\u201cAtlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences,\u201d reads the security advisory.\n\nAtlassian has ascertained that unauthenticated attackers could send a specially crafted HTTP request to bypass custom servlet filters and authentication used by third party apps to enforce authentication, or to bypass the servlet filter used to validate legitimate Atlassian Gadgets and achieve cross-site scripting\u00a0(XSS).\n\nAnother vulnerability allows an unauthenticated attacker to cause additional servlet filters to be invoked when the application processes requests or responses (CVE-2022-26137).\n\nAtlassian said it has addressed the only known, related security issue \u2013 a cross-origin resource sharing\u00a0(CORS) bypass whereby a specially crafted HTTP request could invoke the servlet filter used to respond to CORS requests.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Questions for ConfluenceThe hardcoded credential in Questions for Confluence, a forum-style app for enterprise wiki platform Confluence, is created for a user account with the username disabledsystemuser, which supports administrators in migrating data from the app to Confluence Cloud.\n\nThe disabledsystemuser\u00a0account \u201cis added to the confluence-users group, which allows viewing and editing all non-restricted pages within Confluence by default\u201d, reads the corresponding security advisory.\n\n\u201cA remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access any pages the confluence-users group has access to.\u201d\n\n\u201cWhile Atlassian has not received any reports of this issue being exploited in the wild, the hardcoded password is trivial to obtain,\u201d said Atlassian.\n\nThe flaw (CVE-2022-26138) applies when the Questions for Confluence app is enabled on Confluence Server or Data Center. Confluence Cloud is unaffected.\n\nAtlassian has warned that uninstalling the Questions for Confluence app does not alone remediate the vulnerability, since doing do fails to remove the disabledsystemuser\u00a0account.\n\nInstead, users must either manually deactivate or delete\u00a0these ac[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.160764Z"}