Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134)
Excerpt
This post was authored by Ahmad Shauqi. Overview On June 2, 2022, Atlassian issued a security advisory for it's Confluence Server and Data Center product, highlighting an unauthenticated remote code execution and CVE-2022-26134 was given a critical rating by Atlassian. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. OGNL injection is not a new vulnerability, in fact, there was a CVE…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2022-26134 | High | Score 82/100 | First seen |
| CVE | CVE-2021-26084 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…