PT-2022-7389 · Atlassian+5 · Confluence+5

Katsuragicsl · Published 2022-08-24 · Updated 2025-12-04 · CVE-2022-38900

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions decode-uri-component version 0.2.0 Confluence Data Center versions 7.0.1 through 9.0.x

Description The issue is related to improper input validation, which can result in a denial of service (DoS). This can be exploited by a remote attacker, allowing them to disrupt service availability. The vulnerability has a high impact on availability but does not affect confidentiality or integrity. It requires no user interaction to be exploited.

Recommendations For decode-uri-component version 0.2.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Confluence Data Center versions 7.0.1 through 9.0.x, upgrade to Confluence Data Center 9.1.0 or a later version to resolve the issue. If upgrading to version 9.1.0 or later is not possible, upgrade to a release greater than or equal to 9.1.0.

Exploit

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2023:1743

ALSA-2023:6316

AZL-44976

BDU:2024-05189

CESA-2023_1743

CVE-2022-38900

GHSA-W573-4HG7-7WGQ

RHSA-2023:1533

RHSA-2023:1742

RHSA-2023:1743

RHSA-2023:1744

RHSA-2023:6316

RHSA-2023_1743

RHSA-2023_6316

RLSA-2023:1743

Affected Products

Almalinux

Centos

Confluence

Red Hat

Red Os

Rocky Linux

References · 65

• 🔥 https://github.com/sindresorhus/query-string/issues/345 · Exploit
• 🔥 https://github.com/SamVerschueren/decode-uri-component/issues/5 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-6316.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-38900 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w573-4hg7-7wgq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38900 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2022-38900 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5 · Vendor Advisory