PT-2023-6683 · Atlassian · Confluence

Bala Sathiamurthy · Published 2023-02-17 · Updated 2025-12-29 · CVE-2023-22518

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Data Center and Server versions prior to 7.19.16, 8.3.4, 8.4.4, 8.5.3, and 8.6.1

Description Atlassian Confluence Data Center and Server are affected by an improper authorization vulnerability that allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. An attacker with this access can perform all administrative actions, potentially leading to a full loss of confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2023-22518 and has been assigned a critical severity rating, initially 9.1 and later escalated to 10. Active exploitation of this vulnerability has been observed, with attackers deploying the Cerber ransomware. The attacks leverage the vulnerability to gain access and deploy a Linux variant of the ransomware, creating admin accounts and installing the Effluence web shell plugin. The vulnerability affects all versions of Confluence Data Center and Server and impacts publicly accessible instances. The vulnerability allows attackers to manipulate data, including remotely uploading or deleting files. The attacks exploit the /json/setup-restore.action, /json/setup-restore-local.action, and /json/setup-restore-progress.action endpoints.

Recommendations Upgrade to Confluence Data Center version 7.19.16 or later. Upgrade to Confluence Server version 8.3.4 or later. Upgrade to Confluence Data Center version 8.4.4 or later. Upgrade to Confluence Server version 8.5.3 or later. Upgrade to Confluence Data Center version 8.6.1 or later. If patching is not immediately possible, back up your instance. If patching is not immediately possible, remove your instance from the internet or restrict external network access. If patching is not immediately possible, block access to the /json/setup-restore.action, /json/setup-restore-local.action, and /json/setup-restore-progress.action endpoints.

Exploit

Fix

RCE

Incorrect Authorization

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-863

CWE-327

Related Identifiers

BDU:2023-07453

CVE-2023-22518

Affected Products

Confluence

References · 218

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb · Exploit
• 🔥 https://github.com/ForceFledgling/CVE-2023-22518 · Exploit
• 🔥 https://github.com/RevoltSecurities/CVE-2023-22518 · Exploit
• 🔥 https://github.com/sanjai-AK47/CVE-2023-22518 · Exploit
• 🔥 https://github.com/davidfortytwo/CVE-2023-22518 · Exploit
• 🔥 https://github.com/0x0d3ad/CVE-2023-22518 · Exploit
• 🔥 https://github.com/0x00sector/CVE_2023_22518_Checker · Exploit
• 🔥 http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html · Exploit
• https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22518 · Security Note
• https://jira.atlassian.com/browse/CONFSERVER-93142 · Vendor Advisory
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22518 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22518 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07453 · Security Note