Security News > 2023 > October > Stop what you’re doing and patch this critical Confluence flaw, warns Atlassian
Atlassian has told customers they "Must take immediate action" to address a newly discovered flaw in its Confluence collaboration tool.
An advisory issued on October 31st warns of CVE-2023-22518, described as an "Improper authorization vulnerability in Confluence Data Center and Server", the on-prem versions of Atlassian's products.
All versions of Confluence are susceptible to the bug, which Atlassian rates at 9.1/10 severity on the ten-point Common Vulnerability Scoring System.
The fix is simple: upgrade immediately to version of Confluence that have patched the mysterious flaw.
Atlassian suggests disconnecting Confluence instances from the public internet.
Users of SaaS-y Confluence in Atlassian's cloud have nothing to worry about.
News URL
https://go.theregister.com/feed/www.theregister.com/2023/10/31/critical_atlassian_confluence_flaw/
Related news
- BeyondTrust Issues Urgent Patch for Critical Vulnerability in PRA and RS Products (source)
- Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected (source)
- Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now (source)
- SonicWall Urges Immediate Patch for Critical CVE-2025-23006 Flaw Amid Likely Exploitation (source)
- Patch now: Cisco fixes critical 9.9-rated, make-me-admin bug in Meeting Management (source)
- Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891) (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-10-31 | CVE-2023-22518 | Incorrect Authorization vulnerability in Atlassian Confluence Data Center All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. | 9.8 |