Atlassian has issued an unscheduled advisory, warning that all versions of its Confluence Data Centre and Confluence Server software are susceptible to an improper authorization vulnerability.
The company’s advisory for CVE-2023-22518 contains a message attributed to Atlassian’s CISO, Bala Sathiamurthy, who emphasized that users face a “significant data loss” risk if this vulnerability is exploited. While there are currently no reports of active exploitation, Sathiamurthy urged customers to take immediate action to safeguard their instances. Atlassian has also committed to delivering patches for this issue outside of its regular monthly advisory schedule.
The advisory clarified that “all versions of Confluence Data Center and Server are affected by this unexploited vulnerability.” Notably, there is no impact on data confidentiality since attackers cannot extract any instance data. It’s worth mentioning that Atlassian Cloud sites, accessible through an atlassian.net domain, remain unaffected by this bug.
On the Common Vulnerability Scoring System (CVSS), the bug has a rating of 9.1. Although Atlassian’s description of the vulnerability lacks details, insights from discussions in the bug’s Jira ticket suggest that the issue leads to the leakage of file descriptors.
One user, Martin Palecek from Mavenir, commented that in their case, it’s not attachments but user avatars that leak file descriptors. The rate of leakage appears to be somewhat related to the volume of requests the server is handling.
