PT-2022-26690 · Atlassian+1 · Confluence+1

Published 2022-11-15 · Updated 2022-11-17 · CVE-2022-42978

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netic User Export add-on for Atlassian Confluence versions prior to 1.3.5

Description The issue is related to mishandled authorization in the Netic User Export add-on for Atlassian Confluence. This allows an unauthenticated attacker to access files on the remote system.

Recommendations For versions prior to 1.3.5, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Netic User Export add-on until a patch is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-42978

Affected Products

Confluence

Netic User Export

References · 6

• 🔥 https://gist.github.com/CveCt0r/34251664a511f1045ce6a5492e94eec1 · Exploit
• https://osv.dev/vulnerability/CVE-2022-42978 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42978 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42978 · Security Note
• https://t.me/cvenotify/37707 · Telegram Post
• https://t.me/cibsecurity/52998 · Telegram Post