Atlassian Confluence Data Center and Server CVE-2023-22518 (improper authorization, unauthenticated reset and admin account creation, CISA KEV, ransomware): which versions are fixed and how do I check for compromise?

What it is: CVE-2023-22518, announced by Atlassian on October 31, 2023, is an improper authorization flaw that lets an unauthenticated attacker reset a Confluence instance and create an administrator account, leading to full loss of confidentiality, integrity and availability. Atlassian raised the severity from 9.1 to 10 on November 6, 2023 after seeing active exploitation and ransomware use. CISA added it to the KEV catalog on 2023-11-07. Atlassian Cloud sites (atlassian.net) are not affected. Am I affected: Atlassian says all versions of self-managed Confluence Data Center and Server are affected until updated to a fixed version. Atlassian's fixed versions are 7.19.16, 8.3.4, 8.4.4, 8.5.3 and 8.6.1; Atlassian removed any 'or later' wording, meaning only those listed fix versions (and the latest versions) are patched. Check the version in the page footer or Administration > General Configuration > System Information. Fix: 1. Back up the instance, then upgrade to one of the fixed versions or, better, the latest supported release. 2. If you cannot patch immediately, remove the instance from the internet (including instances with login), and block the three setup-restore endpoints listed in the advisory at the network layer or with the advisory's web.xml security-constraint change plus a restart. This is explicitly limited and not a substitute for patching. 3. Check for compromise. Atlassian lists these indicators: loss of login access, requests to the setup-restore endpoints in network access logs, unknown installed plugins (a malicious plugin named web.shell.Plugin was reported), encrypted files or corrupted data, unexpected members of confluence-administrators, and unexpected new user accounts. If any are found, assume compromise and follow your incident response plan. 4. For a compromised instance, rebuild on clean infrastructure, restore data from a known-good backup taken before the incident, and rotate credentials stored in or reachable from Confluence (database, LDAP/SSO integration, API tokens, application links). Verify: the version shown is a fixed release on all nodes, access logs show no further requests to the setup-restore endpoints from untrusted sources, and the administrator group and plugin list contain only expected entries. Sources: https://confluence.atlassian.com/pages/viewpage.action?pageId=1311473907 https://nvd.nist.gov/vuln/detail/CVE-2023-22518 https://www.cisa.gov/known-exploited-vulnerabilities-catalog