Summary
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.
- Vendor
- Atlassian
- Product
- Confluence Data Center and Server
- Added to KEV
- Nov 7, 2023
- Remediation due
- Nov 28, 2023 (US federal deadline)
- Ransomware use
- Known
- Weakness
- CWE-863
- EPSS
- 100.0% as of Nov 10
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References