CVE-2023-22518

🗓️ 31 Oct 2023 14:30:00Reported by atlassianType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 659 Views🌐 WEB

CVE-2023-22518: Improper Authorization allows unauthenticated attacker to reset Confluence and create admin account

Reporter	Title	Published	Views	Family All 64
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	9 Nov 202306:56	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	20 Nov 202318:58	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	23 Jan 202413:38	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	5 Nov 202306:45	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	2 Nov 202322:52	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	28 Nov 202303:33	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	31 Oct 202305:35	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	31 Oct 202305:35	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	5 May 202502:12	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	5 Nov 202306:45	–	githubexploit

NVD

Vulners

Node

atlassian confluence_data_centerRange1.0–7.19.16

atlassian confluence_data_centerRange7.20.0–8.3.4

atlassian confluence_data_centerRange8.4.0–8.4.4

atlassian confluence_data_centerRange8.5.0–8.5.3

atlassian confluence_data_centerMatch8.6.0

Node

atlassian confluence_serverRange1.0–7.19.16

atlassian confluence_serverRange7.20.0–8.3.4

atlassian confluence_serverRange8.4.0–8.4.4

atlassian confluence_serverRange8.5.0–8.5.3

atlassian confluence_serverMatch8.6.0

[
  {
    "vendor": "Atlassian",
    "product": "Confluence Data Center",
    "versions": [
      {
        "version": "< 1.0.0",
        "status": "unaffected"
      },
      {
        "version": ">= 1.0.0",
        "status": "affected"
      },
      {
        "version": ">= 7.19.16",
        "status": "unaffected"
      },
      {
        "version": ">= 8.3.4",
        "status": "unaffected"
      },
      {
        "version": ">= 8.4.4",
        "status": "unaffected"
      },
      {
        "version": ">= 8.5.3",
        "status": "unaffected"
      },
      {
        "version": ">= 8.6.1",
        "status": "unaffected"
      }
    ]
  },
  {
    "vendor": "Atlassian",
    "product": "Confluence Server",
    "versions": [
      {
        "version": "< 1.0.0",
        "status": "unaffected"
      },
      {
        "version": ">= 1.0.0",
        "status": "affected"
      },
      {
        "version": ">= 7.19.16",
        "status": "unaffected"
      },
      {
        "version": ">= 8.3.4",
        "status": "unaffected"
      },
      {
        "version": ">= 8.4.4",
        "status": "unaffected"
      },
      {
        "version": ">= 8.5.3",
        "status": "unaffected"
      },
      {
        "version": ">= 8.6.1",
        "status": "unaffected"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html
jira	www.jira.atlassian.com/browse/CONFSERVER-93142
confluence	www.confluence.atlassian.com/pages/viewpage.action
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
buildIndex	request body	json/setup-restore.action	Unauthenticated endpoint used to trigger the Confluence restore/restore operation and facilitate creation of an admin account.	CWE-863
edit	request body	json/setup-restore.action	Unauthenticated endpoint used to trigger the Confluence restore/restore operation and facilitate creation of an admin account.	CWE-863
file	request body	json/setup-restore.action	Unauthenticated endpoint used to trigger the Confluence restore/restore operation and facilitate creation of an admin account.	CWE-863
buildIndex	request body	json/setup-restore-local.action	Unauthenticated endpoint variant for triggering vulnerability via local restore flow.	CWE-863
edit	request body	json/setup-restore-local.action	Unauthenticated endpoint variant for triggering vulnerability via local restore flow.	CWE-863
file	request body	json/setup-restore-local.action	Unauthenticated endpoint variant for triggering vulnerability via local restore flow.	CWE-863
buildIndex	request body	json/setup-restore-progress.action	Endpoint to monitor progress of setup/restore operation exploited to gain admin access.	CWE-863
edit	request body	json/setup-restore-progress.action	Endpoint to monitor progress of setup/restore operation exploited to gain admin access.	CWE-863
file	request body	json/setup-restore-progress.action	Endpoint to monitor progress of setup/restore operation exploited to gain admin access.	CWE-863