Confluence flaw severity raised amid mass exploitation

Atlassian reassessed the severity rating of the recent improper authorization vulnerability in Confluence Data Center and Server, raising the CVSS score from 9.1 to a maximum of 10. The company overhauled its security advisory for CVE-2023-22518 after it realized there had been a "change in the scope of the attack" on Monday. In its original advisory, the Aussie-headquartered vendor said exploitation of the vulnerability by an unauthenticated user could lead to "significant data loss." In the recently updated advisory, it conceded an attacker could reset Confluence and create an administrator account. With administrator privileges, an attacker's capabilities in a compromised instance extend far beyond data loss to include malware and ransomware delivery, disable security measures, setting up accounts for long-term access, and more. In addition to reiterating that all versions of Confluence are affected by the vulnerability and should be upgraded as a matter of emergency, Atlassian has now confirmed that active exploitation of the vulnerability has begun, echoing the recent reports from others in the cybersecurity industry. Security company Rapid7 reported a possible mass exploitation event was unfolding as of November 5 after its telemetry picked up on attacks in "various customer environments." "The process execution chain, for the most part, is consistent across multiple environments, indicating possible mass exploitation of vulnerable internet-facing Atlassian Confluence s...