Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Does CVE-2023-22518 impact Confluence 5.8.2

Craig Goldsmith
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
Nov 07, 2023

We are very close to migrating off a old legacy Confluence instance that is currently running 5.8.2. It's internally hosted and limited to only intranet access, so no public access. 


I wanted to confirm 5.8.2 is impacted by CVE-2023-22518 and if so is this mitigation still applicable to our environment. 




      This is possible at the network layer or by making the following changes to Confluence configuration files.

  1. On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>                 <web-resource-collection>                          <url-pattern>/json/setup-restore.action</url-pattern>                          <url-pattern>/json/setup-restore-local.action</url-pattern>                          <url-pattern>/json/setup-restore-progress.action</url-pattern>                          <http-method-omission>*</http-method-omission>                 </web-resource-collection>         <auth-constraint /></security-constraint>

  1. 2. Restart Confluence.


1 answer

0 votes
Marc Koppelaar
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
Nov 08, 2023

Hi @Craig Goldsmith 

Welcome to the community.

As stated in the CVE ( ) 

Not connecting your instance to the internet (no public access) will make your instance not vulnerable.

See point 2 in mitigation.

The configuration file changes are only applicable to point 3 in the mitigation section.

SO in relation that your are not externally able to access Confluence, mitigation point 2will apply to your instance

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events