Atlassian warns of public vulnerability details for a critical flaw in Confluence Data Center and Server, as its CISO urges organizations to apply patches immediately.

CVE-2023-22518: Critical Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Atlassian Confluence Server and Atlassian Confluence Data Center prior to 7.19.16 or 7.20.x prior to 8.3.4 or 8.4.x prior to 8.4.4 and 8.5.x prior to 8.5.3 are affected by an Improper Authorization. This vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account.

Using this account, an attacker can then perform all administrative actions that are available to Confluence instance.

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. There is no impact to confidentiality as an attacker cannot exfiltrate any instance data. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.x prior 7.19.6, 8.x prior to 8.3.4, 8.4.x prior to 8.4.4, 8.5.x prior to 8.5.3 or 8.6.x prior to 8.6.1. It is, therefore, affected by an improper authorization vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-93142 advisory.

  - Improper Authorization in Confluence Data Center and Server (CVE-2023-22518)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114109	Atlassian Confluence Improper Authorization	Web App Scanning	Component Vulnerability	critical
185344	Atlassian Confluence Authentication Bypass (CONFSERVER-93142) (Direct Check)	Nessus	CGI abuses	critical
114105	Atlassian Confluence 8.6.x < 8.6.1 Improper Authorization	Web App Scanning	Component Vulnerability	critical
114104	Atlassian Confluence 8.5.x < 8.5.3 Improper Authorization	Web App Scanning	Component Vulnerability	critical
114103	Atlassian Confluence 8.4.x < 8.4.4 Improper Authorization	Web App Scanning	Component Vulnerability	critical
114102	Atlassian Confluence 8.x < 8.3.4 Improper Authorization	Web App Scanning	Component Vulnerability	critical
114101	Atlassian Confluence 7.x < 7.19.16 Improper Authorization	Web App Scanning	Component Vulnerability	critical
184079	Atlassian Confluence < 7.19.16 / 8.x < 8.3.4 / 8.4.x < 8.4.4 / 8.5.x < 8.5.3 / 8.6.x < 8.6.1 (CONFSERVER-93142)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2023-22518

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical