Back to CVEs & Disclosures
CRITICAL — CVSS 9.8

Atlassian Confluence Broken Access Control Administrator Creation

Broken access control flaw in Atlassian Confluence setup endpoints allowing unauthenticated attackers to re-trigger setup procedures and create rogue administrative accounts.

Status
Vendor Patched
Reported / Disclosed
2023

Impact

  • Access to /setup/setupadministrator.action without valid administrator session.
  • Creation of fully privileged administrator users directly from unauthenticated web requests.
  • Complete compromise of corporate knowledge bases, source credentials, and internal wikis.

Timeline

  1. OCTOBER 4, 2023

    Atlassian released advisory and fixed versions 8.3.3, 8.4.3, 8.5.2.

  2. OCTOBER 10, 2023

    Active zero-day exploitation confirmed across global enterprise instances.

  3. OCTOBER 2023

    WAF blocking rules and URL rewrite mitigations verified.

aura~
Back to CVEs & Disclosures