Atlassian has been reported with a critical vulnerability in their Confluence Software, which several organizations have widely adopted.
The CVE for this vulnerability has been assigned as CVE-2023-22518, and the severity has been given as 9.1 (Critical).
Atlassian has addressed this vulnerability in its recent security advisory and fixed it on its latest version. Additionally, they have also released affected versions of Confluence for this vulnerability.
This vulnerability affects Confluence Data Center and Server customers, potentially leading to significant data loss if exploited by an unauthenticated threat actor. Atlassian hasn’t released any additional details about this vulnerability.
“As part of our continuous security assessment processes, we have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker. There are no reports of active exploitation at this time; however, customers must take immediate action to protect their instances. Please read the Critical Security Advisory below for instructions and vulnerability details,” reads the advisory by Atlassian.
Atlassian also confirmed that publicly accessible Confluence Data Center and Server versions are at critical risk and require immediate attention.
| Product | Affected Versions | Fixed Versions |
| Confluence Data Center and Server | All versions are affected | 7.19.16 or later8.3.4 or later8.4.4 or later8.5.3 or later8.6.1 or later |
To mitigate this issue, Atlassian has recommended their users “Back up the instance” and, if possible, “Remove the instance from the internet until this can be patched.”
Users of these products should upgrade to the latest versions to prevent these vulnerabilities from getting exploited.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.
INE Security, a leading global provider of cybersecurity training and certifications, today announced a new…
In a groundbreaking discovery on November 20, 2024, cybersecurity researchers Shubham Shah and a colleague…
A security flaw found in Android-based kiosk tablets at luxury hotels has exposed a grave…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued six Industrial Control Systems (ICS) advisories…
A sophisticated cyber campaign dubbed "J-magic" has been discovered targeting enterprise-grade Juniper routers with a…
In January, Netskope Threat Labs uncovered a sophisticated global malware campaign leveraging fake CAPTCHA pages…