CVE-2023-22518
CVE-2023-22518
In short
An unauthenticated attacker can reset Confluence and create an admin account without logging in, gaining full control over the system and all its data. This is a critical flaw that affects all on-premises Confluence installations.
Technical detail
CWE-863 (Improper Authorization) allows unauthenticated attackers to bypass authentication controls and invoke administrative functions (instance reset, account creation) without credentials. An attacker can establish persistent administrator access, enabling complete compromise of confidentiality, integrity, and availability across the Confluence instance.
Summary generated and translated by AI from the official description.
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
public PoCs found — 9
githubgithub.com/ForceFledgling/CVE-2023-22518★ 61githubgithub.com/RevoltSecurities/CVE-2023-22518★ 43githubgithub.com/davidfortytwo/CVE-2023-22518★ 8githubgithub.com/0x0d3ad/CVE-2023-22518★ 5githubgithub.com/ductink98lhp/analyze-Exploit-CVE-2023-22518-Confluence★ 1githubgithub.com/bibo318/CVE-2023-22518★ 1githubgithub.com/Lilly-dox/Exploit-CVE-2023-22518★ 1githubgithub.com/C1ph3rX13/CVE-2023-22518★ 0cve_referencepacketstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.htmlhttps://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907https://jira.atlassian.com/browse/CONFSERVER-93142https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518