nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Improper Authorization in Confluence Data Center and Server - CVE-2023-22518

Roland Zosso

I have read all the reports on the internet and I could see that the massive attacks on Confluence happened because the attackers learned pretty quickly how to exploit this vulnerability. As a result, many companies have already been compromised, but no one knows whether they were patched or not. This situation gave rise to the rumor that, despite the patch, this vulnerability had not been closed. However, this was to be expected.

Many companies took precautionary measures and blocked the server on the external network.

Do you know more about this situation? And how can we best deal with it?

Comments

Peter Van de Voorde

Hi @Roland Zosso ,

I would follow Atlassian's instructions as mentioned on this page to deal with this: https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html

Cheers,
Peter

Roland Zosso

hi @Peter Van de Voorde

Thanks for your reply.
I have seen this page and our server is patched.
But there are rumors that despite this patch this vulnerability could be exploited by attackers.
Have you heard anything about this?

Sanjen Bariki_rtm841

Hi @Roland Zosso ,

Did you get a chance to go through the below document.

FAQ for CVE-2023-22518

Regards,

Sanjen

Roland Zosso

Hi @Sanjen Bariki

Thank you!
That is helpful.
I'll go through everything to see if anything happened before updating.

Best regards
Role

Sanjen Bariki_rtm841

Hi @Roland Zosso ,

Thanks for the confirmation.

It will better If you accept the answer, other members will get the solution.

Hit the answer button from left side to help others on this solution.

Regards,

Sanjen😊.

Peter Van de Voorde

@Roland Zosso

I haven't heard any rumors of this still being an issue after the patch.
Of course given the complexity of Confluence there might be other vulnerabilities that haven't been patched yet. There is no guarantee there that I or anyone on this community could give you that there isn't another vulnerability out there.

Cheers,
Peter

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

questions-for-confluence