Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability (CVE-2022-26138)

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2022-08-19 under CISA BOD 22-01.

This is a Use of Hard-coded Credentials (CWE-798) vulnerability in Atlassian Confluence. The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app. Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-07-29 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2022-08-19.