Atlassian Confluence remote code execution vulnerability warning

Respectful master's command:

Hello! Atlassian officially issued a security advisory, disclosing a remote code execution vulnerability in Confluence Server and Confluence Data Center, with vulnerability number CVE-2022-26134. It can cause attackers to remotely execute arbitrary code without authentication and other hazards.

[Vulnerability Rating]

High risk

[Vulnerability description]

CVE-2022-26134

JAtlassian Confluence is a professional enterprise knowledge management and collaboration software that can be used to build enterprise wikis. According to the official description, this vulnerability is caused by OGNL expression injection in the Confluence Server and Data Center versions, which can allow an attacker to inject and execute arbitrary code by sending malicious requests without authentication.

[scope of influence]

Affected versions:

Atlassian Confluence Server and Data Center >= 1.3.0

Atlassian Confluence Server and Data Center < 7.4.17

Atlassian Confluence Server and Data Center < 7.13.7

Atlassian Confluence Server and Data Center < 7.14.3

Atlassian Confluence Server and Data Center < 7.15.2

Atlassian Confluence Server and Data Center < 7.16.4

Atlassian Confluence Server and Data Center < 7.17.4

Atlassian Confluence Server and Data Center < 7.18.1

[Repair Plan]

Currently, the official vulnerability patch and repair version have been released. Affected users are advised to upgrade to a safe version as appropriate:

https://www.atlassian.com/software/confluence/download-archives

[Reference link]

https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html