IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
10.0Crítica KEV Usada en ransomware

CVE-2023-22518Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

Atlassian Confluence Data Center; Atlassian Confluence Server Publicada: (hace 3 años)

Explotación conocida — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

CISA confirmó el 07.11.2023 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 28.11.2023.

Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html; https://nvd.nist.gov/vuln/detail/CVE-2023-22518

Descripción

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.  Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Debilidad (CWE): CWE-863

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Atlassian Confluence Data Center fixed < 1.0.0, >= 1.0.0, fixed >= 7.19.16, fixed >= 8.3.4, fixed >= 8.4.4, fixed >= 8.5.3, fixed >= 8.6.1
Atlassian Confluence Server fixed < 1.0.0, >= 1.0.0, fixed >= 7.19.16, fixed >= 8.3.4, fixed >= 8.4.4, fixed >= 8.5.3, fixed >= 8.6.1

Referencias y parches

Coincidencias CPE (NVD) (10)
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 1.0 < 7.19.16
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 7.20.0 < 8.3.4
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.4
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.3
  • cpe:2.3:a:atlassian:confluence_data_center:8.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 1.0 < 7.19.16
  • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.20.0 < 8.3.4
  • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.4
  • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.3
  • cpe:2.3:a:atlassian:confluence_server:8.6.0:*:*:*:*:*:*:*

CVE recientes del mismo producto — Atlassian Confluence / Jira

9.3Crítica
CVE-2026-21589 KEV

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian Bamboo Data Center; Atlassian Bitbucket Data Center; Atlassian Confluence Data Center; Atlassian Crowd Data Center

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthent…

100%EPSS
7.1Alta
CVE-2026-21586
Atlassian Confluence Data Center

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with …

7.1Alta
CVE-2026-21587
Atlassian Jira Service Management Data Center

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended acces…

7.1Alta
CVE-2026-21588
Atlassian Confluence Data Center

This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1,…

8.6Alta
CVE-2026-21580
Atlassian Confluence Data Center; Atlassian Confluence Server

This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 1…

7.1Alta
CVE-2026-21577
Atlassian Confluence Data Center

This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows …