Main
Vulnerability Database
Exploits
ID:10084 - Exploit for Code Injection in Atlassian Confluence Server and Jira Data Center - CVE-2022-26134
ID:10084 - Exploit for Code Injection in Atlassian Confluence Server and Jira Data Center - CVE-2022-26134
Published: June 21, 2024
Vulnerability identifier: #VU63958
Vulnerability risk: Critical
CVE-ID: CVE-2022-26134
CWE-ID: CWE-94
Exploitation vector: Remote access
Vulnerable software:
Atlassian Confluence Server
Jira Data Center
Atlassian Confluence Server
Jira Data Center
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper input validation when processing OGNL expressions. A remote non-authenticated attacker can send a specially crafted request to the Confluence Server and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.Remediation
Install update from vendor's website.