CVE-2022-26134

Оценки

Оценка EPSS

0.9443

CVSS

3.x 9.8

Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Все оценки CVSS

CVSS 4.0

0.0

CVSS 3.x

9.8

Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0

7.5

Вектор: AV:N/AC:L/Au:N/C:P/I:P/A:P

Описание

В затронутых версиях Confluence Server и Data Center существует уязвимость OGNL для инъекций, которая позволила бы неаутентифицированному злоумышленнику выполнить произвольный код на Confluence Server или Data Center. Пораженные версии от 1.3.0 до 7.4.17, от 7.13.0 до 7.13.7, с 7.14.0 до 7.14.3, с 7.15.0 до 7.15.2, с 7.16.0 до 7.16.4, с 7.17.0 до 7.17.4 и с 7.18.0 до 7.18.1.

Источники

nvd

CWE

CWE-917

Связанные уязвимости

BDU:2022-03284

Эксплойты

ID эксплойта: CVE-2022-26134

Источник: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

ID эксплойта: 50952

Источник: exploitdb

URL: https://www.exploit-db.com/exploits/50952

Справочные ссылки

http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html

http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html

http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html

http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html

https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html

https://jira.atlassian.com/browse/CONFSERVER-79016

https://www.cve.org/CVERecord?id=CVE-2022-26134

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Уязвимое ПО

Тип: Конфигурация

Поставщик: atlassian

Продукт: confluence_data_center

Операционная система: * * *

Характеристика:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.4.17",
      "versionStartIncluding": "1.3",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.13.7",
      "versionStartIncluding": "7.13.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.14.3",
      "versionStartIncluding": "7.14.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.15.2",
      "versionStartIncluding": "7.15.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.16.4",
      "versionStartIncluding": "7.16.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.17.4",
      "versionStartIncluding": "7.17.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.4.17",
      "versionStartIncluding": "1.3",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.13.7",
      "versionStartIncluding": "7.13.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.14.3",
      "versionStartIncluding": "7.14.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.15.2",
      "versionStartIncluding": "7.15.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.16.4",
      "versionStartIncluding": "7.16.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.17.4",
      "versionStartIncluding": "7.17.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Источник: nvd

Тип: Конфигурация

Поставщик: atlassian

Продукт: confluence_server

Операционная система: * * *

Характеристика:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.4.17",
      "versionStartIncluding": "1.3",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.13.7",
      "versionStartIncluding": "7.13.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.14.3",
      "versionStartIncluding": "7.14.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.15.2",
      "versionStartIncluding": "7.15.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.16.4",
      "versionStartIncluding": "7.16.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.17.4",
      "versionStartIncluding": "7.17.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.4.17",
      "versionStartIncluding": "1.3",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.13.7",
      "versionStartIncluding": "7.13.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.14.3",
      "versionStartIncluding": "7.14.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.15.2",
      "versionStartIncluding": "7.15.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.16.4",
      "versionStartIncluding": "7.16.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.17.4",
      "versionStartIncluding": "7.17.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Источник: nvd