Security News > 2023 > October > Stop what you’re doing and patch this critical Confluence flaw, warns Atlassian
Atlassian has told customers they "Must take immediate action" to address a newly discovered flaw in its Confluence collaboration tool.
An advisory issued on October 31st warns of CVE-2023-22518, described as an "Improper authorization vulnerability in Confluence Data Center and Server", the on-prem versions of Atlassian's products.
All versions of Confluence are susceptible to the bug, which Atlassian rates at 9.1/10 severity on the ten-point Common Vulnerability Scoring System.
The fix is simple: upgrade immediately to version of Confluence that have patched the mysterious flaw.
Atlassian suggests disconnecting Confluence instances from the public internet.
Users of SaaS-y Confluence in Atlassian's cloud have nothing to worry about.
News URL
https://go.theregister.com/feed/www.theregister.com/2023/10/31/critical_atlassian_confluence_flaw/
Related news
- Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast (source)
- Qualcomm Urges OEMs to Patch Critical DSP and WLAN Flaws Amid Active Exploits (source)
- VMware fixes bad patch for critical vCenter Server RCE flaw (source)
- Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices (source)
- Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems (source)
- Patch Tuesday: Four Critical Vulnerabilities Paved Over (source)
- Critical 9.8-rated VMware vCenter RCE bug exploited after patch fumble (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-10-31 | CVE-2023-22518 | Incorrect Authorization vulnerability in Atlassian Confluence Data Center All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. | 9.8 |