🚨Patch your Confluence Server/DC instances! (CVE-2023-22518)

[#1]

This bears repeating: please patch your Confluence instances ASAP.

If you are using Confluence Server or Confluence Data Center, update to a fixed version as soon as you can.

👉 See Atlassian's security bulletin for the list of patched versions: https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html

Naturally there are many Confluence admins in the Enterprise group, so this warranted an alert. Atlassian may have already reached out to you directly if you're a technical contact for an active Confluence license.

[Dave Liao]

📌 I will un-pin this article from the Enterprise group on the 20th.

[Bill Bailey]

Would have been nice to have been alerted to this issue before telling the hacker community. Every license has associated technical contacts who could have been contacted before going public.

[Dave Liao]

@Bill Bailey - agreed.

[David Yu]

For the longest time, we've been asking for authentication on all public endpoints if it's operating in private mode. https://jira.atlassian.com/browse/JRASERVER-65521

I guess it's a hard problem to solve; but it would have reduced the severity of a whole class of CVEs.

[hbunjes]

We’ve been attacked starting October 26th. The patch was too late for us unfortunately. I don’t think anyone still has a working confluence instance if it’s not patched. 

I got a mail on Oct 31st from Atlassian regarding this security issue. So, I think Atlassian has informed the customers on time as soon as they could. However, I don’t get the statement „There are no reports of active exploitation at this time“ as there were obviously a lot of attacks at this time for various customers.