Atlassian Questions For Confluence vulnerabilities

3 CVEs affecting Atlassian Questions For Confluence, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-26138, published 2022-07-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability, published 2022-07-20. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-07-29. EPSS: 98.2% chance of exploitation in the next 30 days. The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded…
CVE-2018-13394, published 2018-08-15. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote…
CVE-2018-13393, published 2018-08-15. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0,…