Increase in Exploit Attempts for Atlassian Confluence Server (CVE-2023-22518), (Wed, Dec 20th)

Today, exploit attempts for %%cve:2023-22518%% cross the “significant” threshold for our “First Seen URLs” list. The URL being accessed, “/json/setup-restore.action?synchronous=true”, can be used to bypass authentication [1]. Due to a failure to properly control access to this path, the attacker can execute the “setup-restore” feature, which restores the database using attacker-supplied data and can lead to system command execution.

Article Link: https://isc.sans.edu/diary/rss/30502

1 post - 1 participant

Read full topic

access action atlassian atlassian confluence atlassian confluence server attacker authentication bypass confluence confluence server control control access cve cve-2023-22518 dec exploit failure feature json list path restore restores server threshold today url urls