--- id: "CVE-2023-22518" kind: "vulnerability" aliases: ["CVE-2023-22518"] title: "All versions of Confluence Data Center and Server are affected by this unexploited vulnerability" severity: "critical" cvss: 10.0 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Atlassian Confluence Data Center and Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["7.19.16"], "affected": ">= 1.0, < 7.19.16", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["8.3.4"], "affected": ">= 7.20.0, < 8.3.4", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["8.4.4"], "affected": ">= 8.4.0, < 8.4.4", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["8.5.3"], "affected": ">= 8.5.0, < 8.5.3", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": [], "affected": "= 8.6.0", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["7.19.16"], "affected": ">= 1.0, < 7.19.16", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["8.3.4"], "affected": ">= 7.20.0, < 8.3.4", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["8.4.4"], "affected": ">= 8.4.0, < 8.4.4", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["8.5.3"], "affected": ">= 8.5.0, < 8.5.3", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": [], "affected": "= 8.6.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["atlassian", "aws", "confluence", "exploited", "lab-disclosure", "ransomware", "self-hosted", "vendor"] not_affected_if: ["confluence-cloud"] published_at: "2023-10-31T15:15:08+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T17:33:06+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22518", "first_seen_at": "2026-10-23T22:29:04+00:00"}, {"source": "lab", "url": "https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html", "first_seen_at": "2026-10-24T17:33:06+00:00"}] --- # All versions of Confluence Data Center and Server are affected by this unexploited vulnerability Atlassian Confluence Data Center and Server has an improper authorization flaw that lets an unauthenticated attacker make significant data loss happen. The attacker cannot read data from the instance, but can destroy or alter it. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Atlassian Confluence Data Center and Server affected ? fixed ? - vendor:atlassian confluence data center affected >= 1.0, < 7.19.16 fixed 7.19.16 - vendor:atlassian confluence data center affected >= 7.20.0, < 8.3.4 fixed 8.3.4 - vendor:atlassian confluence data center affected >= 8.4.0, < 8.4.4 fixed 8.4.4 - vendor:atlassian confluence data center affected >= 8.5.0, < 8.5.3 fixed 8.5.3 - vendor:atlassian confluence data center affected = 8.6.0 fixed ? - vendor:atlassian confluence server affected >= 1.0, < 7.19.16 fixed 7.19.16 - vendor:atlassian confluence server affected >= 7.20.0, < 8.3.4 fixed 8.3.4 - vendor:atlassian confluence server affected >= 8.4.0, < 8.4.4 fixed 8.4.4 - vendor:atlassian confluence server affected >= 8.5.0, < 8.5.3 fixed 8.5.3 - vendor:atlassian confluence server affected = 8.6.0 fixed ? ## Fix Apply the mitigation from Atlassian's vendor advisory for CVE-2023-22518, or discontinue use of the product if no mitigation is available (per CISA KEV required action). ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22518 - 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-22518 - 2026-10-24T17:33:06+00:00 lab https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html — AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director ## Documents - [advisory] AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html ## From the sources AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director Introducing a new console experience for AWS WAF You can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console. # AWS Managed Rules changelog This section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019. ###### Note This changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF. For the IP reputation rule groups, this changelog reports changes to the rules and rule group, and it reports significant changes to the sources of the IP address lists that the rules use. It does not report changes to the IP address lists themselves, due to the dynamic nature of those lists. If you have questions about the IP address lists, contact your account manager or open a case at AWS Support Center . | Rule group and rules | Description | Date | | --- | --- | --- | | PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. | 2026-10-22 | | PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.4 of this rule group. The new `PHP2Shell_BODY_Extended` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618. For more information, see NIST: National Vulnerability Database: CVE-2026-109618. This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group. | 2026-10-22 | | PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY` | Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619. For CVE-2026-109618, the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21 | | AWS WAF Bot Control rule group | Released static version 7.0 of this rule group. Added token provenance labels at the targeted protection level. These labels flag a change in the category of IP address between the request that acquired an AWS WAF token and the request that presents it. Added device ID labels at the targeted protection level. These labels come from the device ID that the AWS WAF Android SDK collects. Added the cloud service provider label `awswaf:managed:aws:bot-control:signal:cloud_service_provider:fastly`. For more information, see Bot Control labels. | 2026-10-15 | | SQL database managed rule group This release updates the following rules: `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16 | | Core rule set (CRS) managed rule group This release updates the following rules: `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.23 of this rule group. Improved detection signatures for the cross site scripting rules. | 2026-08-28 | | SQL database managed rule group This release updates the following rules: `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.4 of this rule group. This release updates all rules to improve SQL injection detection logic. | 2026-08-12 | | AWS WAF Bot Control rule group | Released static version 6.1 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, AI, Content Fetcher, Scraping Framework, Search Engine, Security, SEO, and Social Media. | 2026-07-24 | | Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `GenericLFI_BODY` | Released static version 1.22 of this rule group. Improved detection signatures for the generic LFI rules. | 2026-07-20 | | Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.26 of this rule group. Added the `REMOVE_NULLS` text transformation to the listed rule. | 2026-07-15 | | Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_QUERYSTRING` | Released static version 2.5 of this rule group. Removed `WindowsShellCommands_QUERYARGUMENTS` and replaced it with `WindowsShellCommands_QUERYSTRING`. Updated WindowsShellCommands rules to improve detection logic. | 2026-06-01 | | AWS WAF Bot Control rule group | Released static version 6.0 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, Content Fetcher, and Search Engine. Expanded Web Bot Auth support to commercial partition regional AWS WAF integrations. Changed the behavior of Web Bot Auth verified bots to be treated as standard verified bots for all categories, not only the AI category. This static version does not change the default version behavior. | 2026-05-22 | | SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.3 of this rule group. Added new rules `SQLiExtendedPatterns_HEADER` and `SQLiExtendedPatterns_URIPATH`. Added `REPLACE_COMMENTS` text transformations to all rules. Added `JS_DECODE` text transformations to `SQLi_COOKIE`, `SQLi_URIPATH`, and to all the new rules. Updated all the rules to improve detection logic. Version_2.3 is the successor to Version_1.3, not Version_2.0. These are separate lineages with different detection trade-offs. Customers relying on Version_2.0 detection behavior should pin that version explicitly. | 2026-04-29 | | Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_COOKIE` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` | Released static version 2.4 of this rule group. Removed `WindowsShellCommands_COOKIE` and replaced it with `WindowsShellCommands_HEADER` which matches on all headers. Added new rule `WindowsShellCommands_URIPATH`. Added JSON body inspection to the `WindowsShellCommands_BODY`. Added double `URL_DECODE_UNI` and `JS_DECODE` text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28 | | Core rule set (CRS) managed rule group `RestrictedExtensions_QUERYARGUMENTS` `RestrictedExtensions_URIPATH` | Released static version 1.21 of this rule group. Improved detection signatures for these rules. | 2026-04-06 | | PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` `PHPHighRiskMethodsVariables_HEADER` `PHPHighRiskMethodsVariables_URIPATH` | Released static version 2.2 of this rule group. Improved detections and added `PHPHighRiskMethodsVariables_URIPATH` rule. | 2026-03-24 | | AWS WAF Bot Control rule group New rules: `CategoryPagePreview` `CategoryWebhooks` | R --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_