A critical vulnerability, CVE-2023-22518, has been identified in Confluence Data Center and Server, affecting a wide range of systems. This Improper Authorization issue allows unauthenticated attackers to reset Confluence and create a Confluence instance administrator account, leading to a full loss of confidentiality, integrity, and availability. The vulnerability has a severity score of 9.8, indicating its high risk. It is important for organizations using Confluence Data Center and Server to take necessary precautions and update their systems to fixed versions to mitigate this threat.

How do I know if I'm affected?

If you're using Confluence Data Center and Server, you might be affected by the vulnerability. All versions of Confluence Data Center and Server are impacted, including versions 1.0.0 to 7.19.16, 7.20.0 to 8.3.4, 8.4.0 to 8.4.4, 8.5.0 to 8.5.3, and version 8.6.0. This vulnerability allows unauthorized attackers to reset Confluence and create an administrator account, leading to a loss of confidentiality, integrity, and availability. Atlassian Cloud sites are not affected by this issue.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to take action. Update your Confluence Data Center and Server to a fixed version. If you can't patch immediately, apply temporary mitigations like blocking access on certain endpoints. Always back up your instance and, if possible, remove it from the internet until patched. Consult your security team to check for evidence of compromise and follow your security incident response plan if needed.

Is CVE-2023-22518 in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. The CVE-2023-22518 vulnerability, named Atlassian Confluence Data Center and Server Improper Authorization Vulnerability, was added to the catalog on November 7, 2023, with a due date of November 28, 2023. The required action is to apply mitigations as per vendor instructions or discontinue the use of the product if mitigations are unavailable. This means that organizations need to follow the provided guidelines to fix the security issue or stop using the affected software if a solution is not available.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-863, which involves improper authorization in Confluence Data Center and Server, allowing unauthenticated attackers to reset Confluence and create an administrator account, leading to potential loss of confidentiality, integrity, and availability.

For more details

CVE-2023-22518 is a critical vulnerability affecting Confluence Data Center and Server, with severe consequences if exploited. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Packet Storm

• Atlassian Support

• Atlassian Jira

• CISA BOD 22-01