Vulnerability Report

CVE-2023-22518

CISA KEV Active

Title: Atlassian Confluence Server Broken Access Control

Broken Access Control

Proof Of Concept

PoC Available for CVE-2023-22518

CWE Category CWE-863
Published Date Oct 31, 2023
Modified Date Oct 24, 2025
Exploit Status Available
Score 9.8 CVSS v3.1
Exploit Probability (EPSS)
100.00%

Vulnerability Summary

CVE-2023-22518: All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.  Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Impacted Vendors

A
atlassian 2

Reference Links

http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907 https://jira.atlassian.com/browse/CONFSERVER-93142 http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907 https://jira.atlassian.com/browse/CONFSERVER-93142 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.0
Source Entity [email protected]
Severity CRITICAL
10.0
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2023-22518 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/ForceFledgling/CVE-2023-22518
View Code
GitHub https://github.com/RevoltSecurities/CVE-2023-22518
View Code
GitHub https://github.com/0x0d3ad/CVE-2023-22518
View Code
MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.