CVE-2023-22518
Description
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
How to fix
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Nov 28, 2023- atlassian confluence_data_center7.19.16, 8.3.4, 8.4.4, 8.5.3 or later
- atlassian confluence_server7.19.16, 8.3.4, 8.4.4, 8.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian confluence_data_center | 1.0 ≤ v < 7.19.16, 7.20.0 ≤ v < 8.3.4, 8.4.0 ≤ v < 8.4.4, 8.5.0 ≤ v < 8.5.3, 8.6.0 | 7.19.16, 8.3.4, 8.4.4, 8.5.3 |
| atlassian confluence_server | 1.0 ≤ v < 7.19.16, 7.20.0 ≤ v < 8.3.4, 8.4.0 ≤ v < 8.4.4, 8.5.0 ≤ v < 8.5.3, 8.6.0 | 7.19.16, 8.3.4, 8.4.4, 8.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.