Veille CVE

‹ Retour à la liste

CVE-2023-22518

9.8 Critique Exploitée activement Utilisée par des rançongiciels

Publiée le 31/10/2023 à 16:15 · Modifiée le 17/06/2026 à 07:35 · Analysée par le NVD · Source : security@atlassian.com

Catalogue CISA KEV — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

Ajoutée le 07/11/2023 · Échéance de correction (agences US) : 28/11/2023

Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.  Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 9.8 Critique nvd@nist.gov (NVD) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.0 10.0 Critique security@atlassian.com CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Faiblesses (CWE)

Références

Ailleurs