CVE-2023-22518 Confluence Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•19

Detects exploitation attempts of CVE-2023-22518, an improper authorization vulnerability in Confluence Data Center and Server. Attackers can exploit vulnerable endpoints to create admin accounts or execute arbitrary commands. The rule specifically looks for POST requests to known vulnerable URIs associated with setup and restore functionalities.