Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)

Updates on Nov 7, 2023

Summary

An improper authorization bug let unauthenticated attackers reset Confluence Data Center and Server and create a new admin. Within days of disclosure it was exploited to deploy Cerber ransomware. Atlassian Cloud was not affected.

Advisories3

• CVE-2023-22518 - Improper Authorization Vulnerability in Confluence Data Center and ServerAtlassian · Oct 31, 2023
• NVD: CVE-2023-22518NVD
• CISA Known Exploited Vulnerabilities CatalogCISA · Nov 7, 2023