Coverage › CVE-2022-26138

CVE-2022-26138 Mapped Sigma

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Vendor / product

Atlassian — Confluence

Description (CISA)

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

Added to KEV

2022-07-29

Due date

2022-08-19

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-798

CISA notes

https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26138

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

1 mapping object across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1552.001 Credentials In Files exploitation technique

• DET0307 Detect Access to Unsecured Credential Files Across Platforms
  AN0856 Windows

  Correlated file access to insecure credential files (e.g., .env, .xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  Tunable: FileNamePattern ProcessAccessScope TimeWindow
  AN0857 Linux

  File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.

  auditd:SYSCALL open/read of sensitive config or secret files → DC0055 File Access

  auditd:EXECVE grep/cat/awk on files with password fields → DC0064 Command Execution

  linux:syslog authentication success after file access → DC0067 Logon Session Creation

  Tunable: RegexPatterns UserContextScope TimeWindow
  AN0858 macOS

  Terminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.

  macos:unifiedlog grep/cat on files matching credential patterns → DC0064 Command Execution

  macos:unifiedlog open/read of *.plist or .env files → DC0055 File Access

  macos:unifiedlog Keychain or user login post-access → DC0067 Logon Session Creation

  Tunable: KeychainToolAccess FileTypeList
  AN0859 Containers

  Container processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.

  ebpf:syscalls open/read on secret mount paths → DC0055 File Access

  kubernetes:audit process execution involving curl, grep, or awk on secrets → DC0064 Command Execution

  cni:netflow outbound connection to internal or external APIs → DC0082 Network Connection Creation

  Tunable: SecretMountPaths ProcessBaselineDeviation
  AN0860 IaaS

  Access to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.

  CloudTrail:GetObject sensitive credential files in buckets or local image storage → DC0055 File Access

  AWS:CloudTrail command-line execution invoking credential enumeration → DC0064 Command Execution

  AWS:CloudTrail sudden role assumption after credential file access → DC0067 Logon Session Creation

  Tunable: CredentialFilePattern RoleAssumptionScope TimeWindow

Sigma rules tagged attack.t1552.001 (24)

All 24 rules on the technique page →