Improper Authorization in Confluence Data Center and Server - CVE-2023-22518

[Roland Zosso]

I have read all the reports on the internet and I could see that the massive attacks on Confluence happened because the attackers learned pretty quickly how to exploit this vulnerability. As a result, many companies have already been compromised, but no one knows whether they were patched or not. This situation gave rise to the rumor that, despite the patch, this vulnerability had not been closed. However, this was to be expected.

Many companies took precautionary measures and blocked the server on the external network.

Do you know more about this situation? And how can we best deal with it?

[Sanjen Bariki · Accepted solution]

Hi @Roland Zosso ,

Did you get a chance to go through the below document.

• FAQ for CVE-2023-22518 

Regards,

Sanjen

[Roland Zosso]

Hi @Sanjen Bariki 

Thank you!
That is helpful.
I'll go through everything to see if anything happened before updating.

Best regards
Role

[Sanjen Bariki]

Hi @Roland Zosso ,

Thanks for the confirmation.

It will better If you accept the answer, other members will get the solution.

Hit the answer button from left side to help others on this solution.

Regards,

Sanjen😊.

[Peter Van de Voorde]

Hi @Roland Zosso ,

I would follow Atlassian's instructions as mentioned on this page to deal with this: https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html

Cheers,
Peter

[Roland Zosso]

hi @Peter Van de Voorde 

Thanks for your reply.
I have seen this page and our server is patched.
But there are rumors that despite this patch this vulnerability could be exploited by attackers.
Have you heard anything about this?

[Peter Van de Voorde]

@Roland Zosso 

I haven't heard any rumors of this still being an issue after the patch.
Of course given the complexity of Confluence there might be other vulnerabilities that haven't been patched yet. There is no guarantee there that I or anyone on this community could give you that there isn't another vulnerability out there.

Cheers,
Peter