On this page

Atomicorp WAF Rule 337211

Rule Summary

  • Rule ID: 337211
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134) blocked
  • Observed CWEs: CWE-20 (1), CWE-74 (3), CWE-77 (1), CWE-78 (2), CWE-79 (2), CWE-89 (3), CWE-94 (6), CWE-288 (1), CWE-295 (2), CWE-306 (1), CWE-352 (1), CWE-434 (1), CWE-611 (1), CWE-917 (1)
  • Revision: 4
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request URI, Request arguments, JSON request data, SOAP request data, XML request data
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134) blocked” in the request URI, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

CVEs Referenced by This Rule

The current ModSecurity rule metadata explicitly names the following CVEs. These references explain the rule author’s association; they do not claim that the rule is limited to these vulnerabilities or that this is an exhaustive coverage list.

CVE-2022-26134

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVEVulnerabilityProductCVSSSeverity
CVE-2022-24816GeoServer <1.2.2 - Remote Code Executionjai-ext10.0 (v3.1)Critical
CVE-2013-2251Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Executionstruts9.8 (v3.1)Critical
CVE-2017-12611Apache Struts2 S2-053 - Remote Code Executionstruts9.8 (v3.0)Critical
CVE-2018-6220Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6223Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6228Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6229Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2020-14750Oracle WebLogic Server - Remote Command Executionfusion middleware9.8 (v3.1)Critical
CVE-2022-26134Confluence - Remote Code Executionconfluence data center9.8 (v3.1)Critical
CVE-2024-0195SpiderFlow Crawler Platform - Remote Code Executionspider-flow9.8 (v3.1)Critical
CVE-2024-7314AJ-Report < 1.4.1 - Remote Code Executionreport9.8 (v3.1)Critical
CVE-2025-56819Datart v1.0.0-rc.3 - Remote Code Executiondatart9.8 (v3.1)Critical
CVE-2013-1965Apache Struts2 S2-012 RCEstruts9.3 (v2.0)High
CVE-2026-58138Orkes Conductor 3.21.21-3.30.1 - Remote Code Executionconductor9.3 (v4.0)Critical
CVE-2021-21479SCIMono <0.0.19 - Remote Code Executionscimono9.1 (v3.1)Critical
CVE-2018-6224Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway8.8 (v3.0)High
CVE-2021-22053Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Executionspring cloud netflix8.8 (v3.1)High
CVE-2021-25646Apache Druid - Remote Code Executiondruid8.8 (v3.1)High
CVE-2024-28253OpenMetaData - SpEL Injection in PUT /api/v1/policiesopenmetadata8.8 (v3.1)High
CVE-2016-3081Apache S2-032 Struts - Remote Code Executionstruts8.1 (v3.0)High
CVE-2017-12615Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)tomcat8.1 (v3.1)High
CVE-2018-11776Apache Struts2 S2-057 - Remote Code Executionstruts8.1 (v3.1)High
CVE-2018-6221Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway8.1 (v3.0)High
CVE-2018-6222Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway7.8 (v3.0)High
CVE-2007-4556OpenSymphony XWork/Apache Struts2 - Remote Code Executionxwork6.8 (v2.0)Medium
CVE-2012-0392Apache Struts2 S2-008 RCEstruts6.8 (v2.0)Medium
CVE-2018-6230Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway6.8 (v3.0)Medium
CVE-2018-6219Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway6.5 (v3.0)Medium
CVE-2018-6226Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway5.4 (v3.0)Medium
CVE-2018-6227Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway5.4 (v3.0)Medium
CVE-2018-6225Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway4.3 (v3.0)Medium

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWERelated Published CVEs
CWE-20CVE-2017-12611
CWE-74CVE-2013-2251 , CVE-2018-6220 , CVE-2021-21479
CWE-77CVE-2016-3081
CWE-78CVE-2025-56819 , CVE-2018-6222
CWE-79CVE-2018-6226 , CVE-2018-6227
CWE-89CVE-2018-6228 , CVE-2018-6229 , CVE-2018-6230
CWE-94CVE-2022-24816 , CVE-2024-0195 , CVE-2013-1965 , CVE-2026-58138 , CVE-2021-22053 , CVE-2024-28253
CWE-288CVE-2024-7314
CWE-295CVE-2018-6221 , CVE-2018-6219
CWE-306CVE-2018-6223
CWE-352CVE-2018-6224
CWE-434CVE-2017-12615
CWE-611CVE-2018-6225
CWE-917CVE-2022-26134