Improper Authorization Vulnerability In Confluence Data Center and Server (CVE-2023-22518)
Fleury, Terry
CI Operators:
Atlassian has announced a critical vulnerability in Confluence Data Center and Confluence Server [1]. This vulnerability has a CVSS v3 score of 9.1 and is tracked as CVE-2023-22518 [2].
Impact:
An unauthenticated attacker could exploit the vulnerability to cause significant data loss in Confluence Data Center and Confluence Server. While there are no reports of the vulnerability being exploited, customers must take immediate action to protect their instances.
Affected Software:
Confluence Data Center and Confluence Server:
- 7.x < v7.19.16
- 8.3.x < v8.3.4
- 8.4.x < v8.4.4
- 8.5.x < v8.5.3
- 8.6.x < v8.6.1
Recommendation:
Update to the latest version of Confluence Data Center or Server for your installation. If you are unable to update immediately, it is recommended that you backup your instance [3] and prevent access from external networks until you can patch.
References:
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22518
[3] https://confluence.atlassian.com/doc/back-up-a-site-152405.html
How Trusted CI can help:
The potential impact of any vulnerability, and therefore the appropriate response, depends in part on operational conditions that are unique to each cyberinfrastructure deployment. Trusted CI cannot provide a one-size-fits-all severity rating and response recommendation for all NSF cyberinfrastructure. Please contact us (https://trustedci.org/help/) if you need assistance with assessing the potential impact of this vulnerability in your environment and/or you have additional information about this issue that should be shared with the community.