How to confirm logs show no signs of exploitation for CVE-2023-22518

acast2

If a Confluence server is compromised the FAQ page shows examples of what to search for in the logs that could confirm it, but some of the items are not always matching up in regards to the keywords to use for search and what logs these show up in.

Is there a keyword to search for that if not found at all in any of the logs would confirm that it's not compromised?

Dan Breyen

faq-for-cve-2023-22518-1311474094 

improper-authorization-vulnerability-in-confluence-data-center-and-server 

Hi @acast2 Based on those 2 articles I don't see anything like a keyword search to know if it's not compromised.  In my opinion, (for what it's worth) if it was my system, I would go through the mitigation process anyway.

Hope that helps.