ttf

Download

ttf@icann.org

July 2022

1 participants
1 discussions

Ars Technica : Hardcoded password in Confluence app has been leaked on Twitter Advisory had already warned hardcoded password was "trivial to obtain."
by Dev Anand Teelucksingh July 25, 2022

July 25, 2022

“Atlassian on Wednesday revealed three critical product vulnerabilities <https://confluence.atlassian.com/security/july-2022-atlassian-security-advi…>, including CVE-2022-26138 <https://www.cve.org/CVERecord?id=CVE-2022-26138> stemming from a hardcoded password in Questions for Confluence <https://marketplace.atlassian.com/apps/1211644/questions-for-confluence?hos…>, an app that allows users to quickly receive support for common questions involving Atlassian products. The company warned the passcode was "trivial to obtain." The company said that Questions for Confluence had 8,055 installations at the time of publication. When installed, the app creates a Confluence user account named disabledsystemuser, which is intended to help admins move data between the app and the Confluence Cloud service. The hardcoded password protecting this account allows for viewing and editing of all non-restricted pages within Confluence.” Read rest of article: https://arstechnica.com/information-technology/2022/07/atlassian-warns-hard…

1 0