Confluence CVE-2023-22518 Exploitation Attempt via Proxy

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•1•0•22

Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center and Confluence Server. This vulnerability allows an attacker to exploit specific endpoints to potentially create administrator accounts and execute arbitrary commands. The rule identifies POST requests to known vulnerable URIs associated with setup and restore actions, or server information, which are indicative of an exploitation attempt.