Attacker Value

Very High

(1 user assessed)

Exploitability

High

(1 user assessed)

User Interaction

CVE-2023-22518

Disclosure Date: October 31, 2023 •

CVE-2023-22518 CVSS v3 Base Score: 9.8

Exploited in the Wild

Reported by cbeek-r7 and 1 more...
View Source Details

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Initial Access

Techniques

Validation

Exploit Public-Facing Application

Validated

Metasploit Module

exploit/multi/http/atlassian_confluence_unauth_backup

Description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to – but not limited to – full loss of confidentiality, integrity and availability.

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Add Assessment

cbeek-r7 (99)

November 06, 2023 3:53pm UTC (5 months ago)•

Ratings

Attacker Value

Very High

Exploitability

High

CISA KEV Listed Common in enterprise Observed in ransomware attacks

Technical Analysis

Rapid7 observed as of November 5, 2023, exploitation of Atlassian Confluence in multiple customer environments, including for ransomware deployment.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

9.8 Critical

Impact Score:

5.9

Exploitability Score:

3.9

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV):

Network

Attack Complexity (AC):

Low

Privileges Required (PR):

None

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

High

Integrity (I):

High

Availability (A):

High

Vendors

atlassian

Products

confluence data center,
confluence data center 8.6.0,
confluence server,
confluence server 8.6.0

Metasploit Modules

exploit/multi/http/atlassian_confluence_unauth_backup (https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb)

Exploited in the Wild

Reported by:

cbeek-r7 indicated source as Government or Industry Alert (https://www.rapid7.com/blog/post/2023/11/06/etr-rapid7-observed-exploitation-of-atlassian-confluence-cve-2023-22518/)

Reported: November 06, 2023 3:50pm UTC (5 months ago) • Edited 5 months ago

inokii indicated sources as

Vendor Advisory (https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html)
Government or Industry Alert (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
Other: CISA Gov Alert (https://www.cisa.gov/news-events/alerts/2023/11/07/cisa-adds-one-known-exploited-vulnerability-catalog)

Reported: November 12, 2023 3:36am UTC (5 months ago)

References

Canonical

CVE-2023-22518 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22518)

Exploit

The following exploit POCs have not been verified by Rapid7 researchers, but are sourced from: nomi-sec/PoC-in-GitHub.
Additional sources will be added here as they become relevant.
Notes: We will only add the top 3 POCs for a given CVE. POCs added here must have at least 2 GitHub stars.

CVE-2023-22518 (https://github.com/sanjai-AK47/CVE-2023-22518)

CVE-2023-22518 (https://github.com/ForceFledgling/CVE-2023-22518)

CVE-2023-22518 (https://github.com/0x0d3ad/CVE-2023-22518)