Wednesday, April 24, 2024

Atlassian Urged Customers to Fix Critical Confluence Flaw Right Away!

Atlassian has been reported with a critical vulnerability in their Confluence Software, which several organizations have widely adopted.

The CVE for this vulnerability has been assigned as CVE-2023-22518, and the severity has been given as 9.1 (Critical).

Atlassian has addressed this vulnerability in its recent security advisory and fixed it on its latest version. Additionally, they have also released affected versions of Confluence for this vulnerability.

CVE-2023-22518 – Improper Authorization Vulnerability

This vulnerability affects Confluence Data Center and Server customers, potentially leading to significant data loss if exploited by an unauthenticated threat actor. Atlassian hasn’t released any additional details about this vulnerability.

“As part of our continuous security assessment processes, we have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker. There are no reports of active exploitation at this time; however, customers must take immediate action to protect their instances. Please read the Critical Security Advisory below for instructions and vulnerability details,” reads the advisory by Atlassian.

Atlassian also confirmed that publicly accessible Confluence Data Center and Server versions are at critical risk and require immediate attention.

Affected Versions and Fix 

ProductAffected VersionsFixed Versions
Confluence Data Center and ServerAll versions are affected7.19.16 or later8.3.4 or later8.4.4 or later8.5.3 or later8.6.1 or later


To mitigate this issue, Atlassian has recommended their users “Back up the instance” and, if possible, “Remove the instance from the internet until this can be patched.”

Users of these products should upgrade to the latest versions to prevent these vulnerabilities from getting exploited. 

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.


Latest articles

Phishing Attacks Rise By 58% As The Attackers Leverage AI Tools

AI-powered generative tools have supercharged phishing threats, so even newbie attackers can effortlessly create...

Multiple MySQL2 Flaw Let Attackers Arbitrary Code Remotely

The widely used MySQL2 has been discovered to have three critical vulnerabilities: remote Code...

CoralRaider Hacker Evade Antivirus Detections Using Malicious LNK File

This campaign is observed to be targeting multiple countries, including the U.S., Nigeria, Germany,...

Spyroid RAT Attacking Android Users to Steal Confidential Data

A new type of Remote Access Trojan (RAT) named Spyroid has been identified.This...

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles