CVE-2023-22518 | All versions of Confluence Data Center and Server are affect… | CVSS 10.0 CRITICAL

Description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Metadata

CVE ID: CVE-2023-22518
State: PUBLISHED
Assigner: atlassian
Reserved: 2023-01-01 00:01 UTC
Published: 2023-10-31 14:30 UTC
Last updated: 2025-10-21 23:05 UTC
Primary CWE: CWE-863
CWE-863 Incorrect Authorization
Vendor / Product: Atlassian / Confluence Data Center
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: ACTIVE
Automatable: yes
Tech. Impact: partial

CISA Known Exploited Vulnerability

Vulnerability name: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Vendor: Atlassian
Product: Confluence Data Center and Server
Added to KEV: 2023-11-07
Due date: 2023-11-28
Ransomware: Known use

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description

Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.

Affected products (2)

Vendor	Product	Platform	Versions
Atlassian	Confluence Data Center	—	< 1.0.0, >= 1.0.0, >= 7.19.16, >= 8.3.4 …
Atlassian	Confluence Server	—	< 1.0.0, >= 1.0.0, >= 7.19.16, >= 8.3.4 …

Weakness (CWE)

CWE	Source	Description
—	cna	Improper Authorization
CWE-863	adp	CWE-863 Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (3)