According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.x prior 7.19.6, 8.x prior to 8.3.4, 8.4.x prior to 8.4.4, 8.5.x prior to 8.5.3 or 8.6.x prior to 8.6.1. It is, therefore, affected by an improper authorization vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Atlassian Confluence Server and Atlassian Confluence Data Center prior to 7.19.16 or 7.20.x prior to 8.3.4 or 8.4.x prior to 8.4.4 and 8.5.x prior to 8.5.3 are affected by an Improper Authorization. This vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account.

Using this account, an attacker can then perform all administrative actions that are available to Confluence instance.

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. There is no impact to confidentiality as an attacker cannot exfiltrate any instance data. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-93142 advisory.

  - Improper Authorization in Confluence Data Center and Server (CVE-2023-22518)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
114102	Atlassian Confluence 8.x < 8.3.4 Improper Authorization	Web App Scanning	Component Vulnerability	11/7/2023	11/15/2023	critical
114109	Atlassian Confluence Improper Authorization	Web App Scanning	Component Vulnerability	11/15/2023	11/15/2023	critical
114103	Atlassian Confluence 8.4.x < 8.4.4 Improper Authorization	Web App Scanning	Component Vulnerability	11/7/2023	11/15/2023	critical
114101	Atlassian Confluence 7.x < 7.19.16 Improper Authorization	Web App Scanning	Component Vulnerability	11/7/2023	11/15/2023	critical
114104	Atlassian Confluence 8.5.x < 8.5.3 Improper Authorization	Web App Scanning	Component Vulnerability	11/7/2023	11/15/2023	critical
114105	Atlassian Confluence 8.6.x < 8.6.1 Improper Authorization	Web App Scanning	Component Vulnerability	11/7/2023	11/15/2023	critical
185344	Atlassian Confluence Authentication Bypass (CONFSERVER-93142) (Direct Check)	Nessus	CGI abuses	11/8/2023	5/20/2024	critical
184079	Atlassian Confluence < 7.19.16 / 8.x < 8.3.4 / 8.4.x < 8.4.4 / 8.5.x < 8.5.3 / 8.6.x < 8.6.1 (CONFSERVER-93142)	Nessus	CGI abuses	10/31/2023	12/22/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical