Active Exploit for CVE-2023-22518?

[Akira Okumura]

Has anyone experienced an active exploit for the latest critical issue CVE-2023-22518?

https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html

On Oct 31, I first thought that the vulnerability could erase my Confluence data. However in my case, the data and its backup files have been encrypted by a ransom attacker on Nov 6.

On Nov 3, the above page added a note that "We received a customer report of an active exploit" but I was not aware of it till Nov 6.

I am wondering if my ransom issue is relevant to CVE-2023-22518.

I was using an old version 7.5.1 (with all possible patches) for some reason.

[Stephen Sifers]

Hello @Akira Okumura 

Very unfortunate to hear your Confluence Server was impacted by a ransomware event. I see you've submitted a support request related to this issue. The support teams will be able to further understand your issue and provide clarity on if the CVE was related.

Regards,
Stephen Sifers