Recent Security Advisories (CVE-2022-26138, CVE-2022-26136, CVE-2022-26137)

[Javier Olivera]

What action should cloud customers (Confluence) need to take to keep corporate information secure? Is there any corrective action that customers need to take?

[Kian Stack Mumo Systems · Accepted solution]

@Javier Olivera, According to the security advisory, there are no actions which need to be taken for Atlassian Cloud.

[Robert Wen_Cprime_ · Accepted solution]

Hello @Javier Olivera ! Welcome to the Atlassian community!

Cloud products are not affected by the vulnerabilities identified.  You don't have to do anything.

[Samuel Leung]

For CVE-2022-26138. In regards to the instruction for How To Determine If You Are Affected. Does "If this account does not show up in the list of active users" simply imply the list of users found at the following location:

1. Settings Cog top right > User Management > List Users > Find user = dontdeletethisuser@email.com

Or does Atlassian require us to go above and beyond with some fancy way of digging into users that do not appear on the Active Users list within the webgui administration?

[Pankaj Rana]

Do we have any workarounds for CVE-2022-26136, CVE-2022-26137?

[Robert Wen_Cprime_]

according to the article below, no workarounds.

https://confluence.atlassian.com/security/multiple-products-security-advisory-cve-2022-26136-cve-2022-26137-1141493031.html