“Atlassian on Wednesday revealed three critical product vulnerabilities <https://confluence.atlassian.com/security/july-2022-atlassian-security-advis...>, including CVE-2022-26138 <https://www.cve.org/CVERecord?id=CVE-2022-26138> stemming from a hardcoded password in Questions for Confluence <https://marketplace.atlassian.com/apps/1211644/questions-for-confluence?host...>, an app that allows users to quickly receive support for common questions involving Atlassian products. The company warned the passcode was "trivial to obtain." The company said that Questions for Confluence had 8,055 installations at the time of publication. When installed, the app creates a Confluence user account named disabledsystemuser, which is intended to help admins move data between the app and the Confluence Cloud service. The hardcoded password protecting this account allows for viewing and editing of all non-restricted pages within Confluence.” Read rest of article: https://arstechnica.com/information-technology/2022/07/atlassian-warns-hardc...