Skip to content

CVE · Exploited · On CISA KEV

CVE-2023-22518

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

9.8
CVSS 3.1
1
story
NOV 7
added to KEV
Severity
9.8 Critical · NVD score
Vendor
Atlassian
Product
Confluence Data Center and Server
Published
Oct 31, 2023
Added to KEV
Nov 7, 2023
KEV deadline
Nov 28, 2023
Ransomware use
Known
Weakness
CWE-863

What it is

Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. IntrusionsRussian Hackers Target Misconfigured Edge Devices in ‘Concerning Evolution’ For Critical Infrastructure AttacksAmazon researchers highlighted a “tactical pivot” by Russian GRU hackers who have been moving away from zero-day and N-day exploitation.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixconfluence.atlassian.com/pages/viewpage.actionFixjira.atlassian.com/browse/CONFSERVER-93142Fixconfluence.atlassian.com/pages/viewpage.actionFixjira.atlassian.com/browse/CONFSERVER-93142