Filtered by vendor Atlassian Subscriptions
Filtered by product Questions For Confluence Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-26138 1 Atlassian 3 Confluence Data Center, Confluence Server, Questions For Confluence 2024-09-17 9.8 Critical
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
CVE-2018-13394 1 Atlassian 1 Questions For Confluence 2024-09-16 N/A
The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote attackers to modify a comment into an answer via a Cross-site request forgery (CSRF) vulnerability.
CVE-2018-13393 1 Atlassian 1 Questions For Confluence 2024-09-16 N/A
The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote attackers to modify a comment into an answer via a Cross-site request forgery (CSRF) vulnerability.