Veille CVE

‹ Retour à la liste

CVE-2022-26134

9.8 Critique Exploitée activement Utilisée par des rançongiciels

Publiée le 04/06/2022 à 00:15 · Modifiée le 17/06/2026 à 06:34 · Analysée par le NVD · Source : security@atlassian.com

Catalogue CISA KEV — Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

Ajoutée le 02/06/2022 · Échéance de correction (agences US) : 06/06/2022

Action requise : Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

Description

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 9.8 Critique nvd@nist.gov (NVD) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1 9.8 Critique 134c704f-9b21-4f2e-91b3-4a467353bcc0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2.0 7.5 Élevée nvd@nist.gov (NVD) AV:N/AC:L/Au:N/C:P/I:P/A:P

Faiblesses (CWE)

Références

Ailleurs