CVE-2023-22518criticalunder attackransomwareCWE-863

CVE-2023-22518: critical vulnerability in Atlassian Confluence Data Center

Published · Updated

Follow this CVE+ Monitor Confluence Server+ Monitor Confluence Data Center

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 100%
from disclosure to weaponsame day
Published on NVDOct 31
1st PoCOct 31
metasploitOct 31
CISA KEV+7d
Action required by CISAfederal deadline: 2023-11-28

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An unauthenticated attacker can reset Confluence and create an admin account without logging in, gaining full control over the system and all its data. This is a critical flaw that affects all on-premises Confluence installations.

Technical detail

CWE-863 (Improper Authorization) allows unauthenticated attackers to bypass authentication controls and invoke administrative functions (instance reset, account creation) without credentials. An attacker can establish persistent administrator access, enabling complete compromise of confidentiality, integrity, and availability across the Confluence instance.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.  Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Atlassian · Confluence Data CenterAtlassian · Confluence Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Atlassian Confluence Data Center

In the same product, most dangerous first.

CVE-2022-26134CRITICALCVE-2022-26134EPSS 100.0%KEVCVE-2021-26084CRITICALCVE-2021-26084EPSS 100.0%KEVCVE-2023-22527CRITICALCVE-2023-22527EPSS 100.0%KEVCVE-2021-26085MEDIUMCVE-2021-26085EPSS 99.9%KEVCVE-2019-3396CRITICALCVE-2019-3396EPSS 99.9%KEVCVE-2026-21589CRITICALCVE-2026-21589EPSS 99.7%KEV