...
Atlassian rates the severity level of this vulnerability as Critical CVSS 10, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low. This is our assessment, and you should evaluate its applicability to your own IT environment.
CVE-2023-22515 - Broken Access Control Vulnerability in Confluence Data Center and Server
...
Product | Affected Versions |
---|---|
Confluence Data Center and Confluence Server |
|
What You Need To Do
Immediately patch to a fixed version
Atlassian recommends that you patch each of your affected installations to one of the listed fixed versions (or any later version) below.
Product | Fixed Versions |
---|---|
Confluence Data Center and Server |
|
Apply temporary mitigations if unable to patch
- Back up your instance. (Instructions: https://confluence.atlassian.com/doc/production-backup-strategy-38797389.html)
- Remove your instance from the internet until you can patch, if possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can patch.
- If you cannot restrict external network access or patch, apply the following interim measures to mitigate known attack vectors by blocking access on the following endpoints on Confluence instances:
/json/setup-restore.action
/json/setup-restore-local.action
/json/setup-restore-progress.action
- This is possible at the network layer or by making the following changes to Confluence configuration files.
On each node, modify/<confluence-install-dir>/confluence/WEB-INF/web.xml
and add the following block of code (just before the</web-app>
tag at the end of the file):Code Block <security-constraint> <web-resource-collection> <url-pattern>/json/setup-restore.action</url-pattern> <url-pattern>/json/setup-restore-local.action</url-pattern> <url-pattern>/json/setup-restore-progress.action</url-pattern> <http-method-omission>*</http-method-omission> </web-resource-collection> <auth-constraint /> </security-constraint>
- Restart Confluence.
Note: These mitigation actions are limited and not a replacement for patching your instance; you must patch as soon as possible
For more information, please connect to https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html