{"id":"CVE-2023-22518","published":"2023-10-31T15:15:08Z","modified":"2026-06-17T05:35:37Z","title":"Atlassian Confluence Data Center and Server Improper Authorization Vulnerability","vendor":"Atlassian","product":"Confluence Data Center and Server","tier":"core","eol":null,"description":{"text":"All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. \n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.","provenance":"source","from":"NVD"},"summary":{"text":"An improper authorization flaw in Atlassian Confluence Data Center and Server allows an attacker to reset the instance and create a new administrator account. An unauthenticated attacker with network access to the instance, requiring no user interaction or special configuration, can use that account to perform any instance administrator action, compromising confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:56:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99996,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-11-07","dueDate":"2023-11-28","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-22518","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-11-02","exploitedFirstSeen":"2023-11-06","ransomware":true,"evidence":[{"url":"https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-confluence-server-1311473907.html","date":"2023-11-06"},{"url":"https://isc.sans.edu/diary/Exploit%20Activity%20for%20CVE-2023-22518%2C%20Atlassian%20Confluence%20Data%20Center%20and%20Server/30376","date":"2023-11-06"},{"url":"https://redcanary.com/blog/confluence-exploit-ransomware/","date":"2023-11-06"},{"url":"https://www.rapid7.com/blog/post/2023/11/06/etr-rapid7-observed-exploitation-of-atlassian-confluence-cve-2023-22518/","date":"2023-11-06"},{"url":"https://x.com/TheDFIRReport/status/1721576960675954959","date":"2023-11-06"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-11-07"},{"url":"https://cert.360.cn/report/detail?id=654c976eea0822e915605f1e","date":"2023-11-09"},{"url":"https://www.aon.com/cyber-solutions/aon_cyber_labs/detecting-effluence-an-unauthenticated-confluence-web-shell/","date":"2023-11-10"},{"url":"https://www.trendmicro.com/en_us/research/23/k/cerber-ransomware-exploits-cve-2023-22518.html","date":"2023-11-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2023-22518","date":"2023-11-13"}],"evidenceTotal":910,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-93142","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-93142","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22518","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery and downloading malicious payloads.","confidence":"high"},{"id":"T1033","name":"System Owner/User Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"primary_impact","evidence":[],"comment":"CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery, downloading malicious payloads,  ","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-22518 is an improper authorization vulnerability. Adversaries have been seen using HTTP POST requests to upload maliciously-crafted zip files to Confluence WebServers to exploit this vulnerability. After exploitation, adversaries were observed doing local system information discovery, downloading malicious payloads,  ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-26658","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26658","exploited":true,"exploitedSince":"2023-11-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":8,"skipped":0,"earliest":"2023-10-31","earliestUrl":"https://github.com/ForceFledgling/CVE-2023-22518","repos":[{"name":"ForceFledgling/CVE-2023-22518","url":"https://github.com/ForceFledgling/CVE-2023-22518","stars":61,"created":"2023-10-31"},{"name":"RevoltSecurities/CVE-2023-22518","url":"https://github.com/RevoltSecurities/CVE-2023-22518","stars":43,"created":"2023-11-05"},{"name":"davidfortytwo/CVE-2023-22518","url":"https://github.com/davidfortytwo/CVE-2023-22518","stars":8,"created":"2023-11-02"},{"name":"0x0d3ad/CVE-2023-22518","url":"https://github.com/0x0d3ad/CVE-2023-22518","stars":5,"created":"2023-11-09"},{"name":"bibo318/CVE-2023-22518","url":"https://github.com/bibo318/CVE-2023-22518","stars":1,"created":"2024-01-23"}]},"metasploit":[{"name":"Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518)","module":"exploit/multi/http/atlassian_confluence_unauth_backup","type":"exploit","disclosureDate":"2023-10-31","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_unauth_backup.rb"}],"nuclei":[{"id":"CVE-2023-22518","name":"Atlassian Confluence Server - Improper Authorization","severity":"critical","path":"http/cves/2023/CVE-2023-22518.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22518.yaml"}],"first":{"date":"2023-10-31","source":"PoC-in-GitHub","url":"https://github.com/ForceFledgling/CVE-2023-22518"},"provenance":"source"},"detections":{"cveRules":[{"title":"CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)","id":"f8987c03-4290-4c96-870f-55e75ee377f4","level":"high","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml","techniques":["T1059","T1190"]},{"title":"CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)","id":"1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db","level":"medium","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml","techniques":["T1059","T1190"]},{"title":"CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)","id":"27d2cdde-9778-490e-91ec-9bd0be6e8cc6","level":"medium","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/proxy_exploit_cve_2023_22518_confluence_auth_bypass.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proxy_exploit_cve_2023_22518_confluence_auth_bypass.yml","techniques":["T1190"]},{"title":"CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)","id":"a902d249-9b9c-4dc4-8fd0-fbe528ef965c","level":"medium","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/web_exploit_cve_2023_22518_confluence_auth_bypass.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/web_exploit_cve_2023_22518_confluence_auth_bypass.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/176264/Atlassian-Confluence-Improper-Authorization-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1033"],"provenance":"source"},{"stage":"secondary","techniques":["T1105"],"provenance":"source"}],"timeline":[{"date":"2023-10-31","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22518","provenance":"source"},{"date":"2023-10-31","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2023-10-31","url":"https://github.com/ForceFledgling/CVE-2023-22518","provenance":"source"},{"date":"2023-11-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-confluence-server-1311473907.html","provenance":"source"},{"date":"2023-11-07","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-11-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26658","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":7},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1094 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 8 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}