Servers and applications
CVE-2023-22518
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to -…
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 7 Nov 2023.
- Severity
- Critical 9.8
- Published
- 31 Oct 2023
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 7.19.16, 8.3.4, 8.4.4, 8.5.3
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
ConfluenceServers and applications · cpe:a:atlassian:confluence_data_center |
|
ConfluenceServers and applications · cpe:a:atlassian:confluence_server |
|
Known exploited
- CISA name
- Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Due for US agencies
- 28 Nov 2023
- Used in ransomware
- Yes, known