Actively exploited · Published Oct 31, 2023 · Assigned by atlassian

CVE-2023-22518

Critical 10.0 Exploited Ransomware

In plain English

A critical-severity incorrect authorization in Confluence Data Center from Atlassian. Attackers are actively exploiting it in the wild (listed by CISA on November 7, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.0)10.0Critical

Exploit odds (30 days)100.0%top 0.0% of all CVEs

Exploited in the wildYesCISA KEV since Nov 7, 2023

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Nov 28, 2023.

Official description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Affected products (as reported)

Vendor	Product	Versions
Atlassian	Confluence Data Center	>= 1.0.0
Atlassian	Confluence Server	>= 1.0.0

Weakness: CWE-863 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

CISA guidance

Official description

Affected products (as reported)

References