CVE-2023-22515 (GCVE-0-2023-22515)

Vulnerability from cvelistv5 – Published: 2023-10-04 14:00 – Updated: 2026-03-25 14:56
VLAI? CISA KEV EUVD KEV
Summary
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Severity ?
10 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
  • BASM (Broken Authentication & Session Management)
Assigner
References
Impacted products
Vendor Product Version
Atlassian Confluence Data Center Unaffected: < 8.0.0
Affected: >= 8.0.0
Affected: >= 8.0.1
Affected: >= 8.0.2
Affected: >= 8.0.3
Affected: >= 8.1.3
Affected: >= 8.1.4
Affected: >= 8.2.0
Affected: >= 8.2.1
Affected: >= 8.2.2
Affected: >= 8.2.3
Affected: >= 8.3.0
Affected: >= 8.3.1
Affected: >= 8.3.2
Affected: >= 8.4.0
Affected: >= 8.4.1
Affected: >= 8.4.2
Affected: >= 8.5.0
Affected: >= 8.5.1
Unaffected: >= 8.3.3
Unaffected: >= 8.4.3
Unaffected: >= 8.5.2
Create a notification for this product.
Atlassian Confluence Server Unaffected: < 8.0.0
Affected: >= 8.0.0
Affected: >= 8.0.1
Affected: >= 8.0.2
Affected: >= 8.0.3
Affected: >= 8.1.3
Affected: >= 8.1.4
Affected: >= 8.2.0
Affected: >= 8.2.1
Affected: >= 8.2.2
Affected: >= 8.2.3
Affected: >= 8.3.0
Affected: >= 8.3.1
Affected: >= 8.3.2
Affected: >= 8.4.0
Affected: >= 8.4.1
Affected: >= 8.4.2
Affected: >= 8.5.0
Affected: >= 8.5.1
Unaffected: >= 8.3.3
Unaffected: >= 8.4.3
Unaffected: >= 8.5.2
Create a notification for this product.
Credits
an Atlassian customer
CISA KEV
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: a07b4140-f093-457c-90f5-bd5ce5e31683

Vulnerability ID: CVE-2023-22515

Status: Confirmed

Status Updated: 2023-10-05 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2023-10-05
Asserted: 2023-10-05
Scope
Notes: KEV entry: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | Affected: Atlassian / Confluence Data Center and Server | Description: Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA. | Due date: 2023-10-13 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html; https://nvd.nist.gov/vuln/detail/CVE-2023-22515
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes
Feed CISA Known Exploited Vulnerabilities Catalog
Product Confluence Data Center and Server
Due Date 2023-10-13
Date Added 2023-10-05
Vendorproject Atlassian
Vulnerabilityname Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Knownransomwarecampaignuse Known
References
Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC
EUVD KEV
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: dfdef7f2-d2d7-466c-a13a-0e88f69d1165

Vulnerability ID: CVE-2023-22515

Status: Confirmed

Status Updated: 2025-01-23 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2025-01-23
Asserted: 2025-01-23
Scope
Notes: Affected: Atlassian / Confluence Server and Data Server | Exploitation type: ransomware | Origin source: cnw
Evidence

Type: Csirt Report

Signal: Confirmed Compromise

Confidence: 75%

Source: enisa-cnw-kev

Details
Cwes -
Euvd EUVD-2023-26655
Notes -
Catalog ENISA / EU CSIRTs Network (CNW) KEV CSV
Product Confluence Server and Data Server
Datereported 23/01/25
Originsource cnw
Vendorproject Atlassian
Exploitationtype ransomware
Vulnerabilityname -
Threatactorsexploiting -
References
Created: 2026-02-02 12:25 UTC | Updated: 2026-02-06 07:17 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:13:48.693Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-92475"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-22515",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-12-09T05:05:17.297744Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-10-05",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T14:56:37.404Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003c 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.1"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.3.3"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.4.3"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.5.2"
            }
          ]
        },
        {
          "product": "Confluence Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003c 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.1"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.3.3"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.4.3"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.5.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "an Atlassian customer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. \r\n\r\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "BASM (Broken Authentication \u0026 Session Management)",
              "lang": "en",
              "type": "BASM (Broken Authentication \u0026 Session Management)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-20T16:00:01.026Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html"
        },
        {
          "url": "https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515"
        },
        {
          "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276"
        },
        {
          "url": "https://jira.atlassian.com/browse/CONFSERVER-92475"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2023-22515",
    "datePublished": "2023-10-04T14:00:00.820Z",
    "dateReserved": "2023-01-01T00:01:22.331Z",
    "dateUpdated": "2026-03-25T14:56:37.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2023-22515",
      "dateAdded": "2023-10-05",
      "dueDate": "2023-10-13",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-22515",
      "product": "Confluence Data Center and Server",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.",
      "shortDescription": "Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.",
      "vendorProject": "Atlassian",
      "vulnerabilityName": "Atlassian Confluence Data Center and Server Broken Access Control Vulnerability"
    },
    "cnw_known_exploited": {
      "CVE": "CVE-2023-22515",
      "EUVD": "EUVD-2023-26655",
      "cwes": "-",
      "dateReported": "23/01/25",
      "exploitationType": "ransomware",
      "notes": "-",
      "originSource": "cnw",
      "product": "Confluence Server and Data Server",
      "shortDescription": "-",
      "threatActorsExploiting": "-",
      "vendorProject": "Atlassian",
      "vulnerabilityName": "-"
    },
    "epss": {
      "cve": "CVE-2023-22515",
      "date": "2026-05-13",
      "epss": "0.94326",
      "percentile": "0.99954"
    },
    "fkie_nvd": {
      "cisaActionDue": "2023-10-13",
      "cisaExploitAdd": "2023-10-05",
      "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.",
      "cisaVulnerabilityName": "Atlassian Confluence Data Center and Server Broken Access Control Vulnerability",
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndExcluding\": \"8.3.3\", \"matchCriteriaId\": \"85B2AD9F-CBA6-4559-9AE3-5F76A9EC3B7F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.4.0\", \"versionEndExcluding\": \"8.4.3\", \"matchCriteriaId\": \"38F9918D-6848-4CD6-8096-4FB48C23818B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.5.0\", \"versionEndExcluding\": \"8.5.2\", \"matchCriteriaId\": \"8D646BCF-214F-449D-AEEB-B253E8715394\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndExcluding\": \"8.3.3\", \"matchCriteriaId\": \"970A3DA7-5114-4696-A93D-C3D5AFF5C6C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.4.0\", \"versionEndExcluding\": \"8.4.3\", \"matchCriteriaId\": \"A2EB19CD-AE29-4775-91C5-05B01A96AC6C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.5.0\", \"versionEndExcluding\": \"8.5.2\", \"matchCriteriaId\": \"79229BE7-0AA0-4308-8BB2-8FB11E8B9AD7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. \\r\\n\\r\\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue. \"}, {\"lang\": \"es\", \"value\": \"Atlassian ha sido informado de un problema informado por un pu\\u00f1ado de clientes en el que atacantes externos pueden haber explotado una vulnerabilidad previamente desconocida en instancias de Confluence Data Center and Server de acceso p\\u00fablico para crear cuentas de administrador de Confluence no autorizadas y acceder a instancias de Confluence. Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a trav\\u00e9s de un dominio atlassian.net, est\\u00e1 alojado en Atlassian y no es vulnerable a este problema.\"}]",
      "id": "CVE-2023-22515",
      "lastModified": "2024-11-21T07:44:57.830",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV30\": [{\"source\": \"security@atlassian.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 10.0, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 6.0}]}",
      "published": "2023-10-04T14:15:10.440",
      "references": "[{\"url\": \"http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html\", \"source\": \"security@atlassian.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515\", \"source\": \"security@atlassian.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276\", \"source\": \"security@atlassian.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-92475\", \"source\": \"security@atlassian.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-92475\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@atlassian.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-22515\",\"sourceIdentifier\":\"security@atlassian.com\",\"published\":\"2023-10-04T14:15:10.440\",\"lastModified\":\"2026-03-25T17:40:00.140\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. \\r\\n\\r\\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.\"},{\"lang\":\"es\",\"value\":\"Atlassian ha sido informado de un problema informado por un pu\u00f1ado de clientes en el que atacantes externos pueden haber explotado una vulnerabilidad previamente desconocida en instancias de Confluence Data Center and Server de acceso p\u00fablico para crear cuentas de administrador de Confluence no autorizadas y acceder a instancias de Confluence. Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a trav\u00e9s de un dominio atlassian.net, est\u00e1 alojado en Atlassian y no es vulnerable a este problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"security@atlassian.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}]},\"cisaExploitAdd\":\"2023-10-05\",\"cisaActionDue\":\"2023-10-13\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.\",\"cisaVulnerabilityName\":\"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.3.3\",\"matchCriteriaId\":\"85B2AD9F-CBA6-4559-9AE3-5F76A9EC3B7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0\",\"versionEndExcluding\":\"8.4.3\",\"matchCriteriaId\":\"38F9918D-6848-4CD6-8096-4FB48C23818B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndExcluding\":\"8.5.2\",\"matchCriteriaId\":\"8D646BCF-214F-449D-AEEB-B253E8715394\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.3.3\",\"matchCriteriaId\":\"970A3DA7-5114-4696-A93D-C3D5AFF5C6C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0\",\"versionEndExcluding\":\"8.4.3\",\"matchCriteriaId\":\"A2EB19CD-AE29-4775-91C5-05B01A96AC6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndExcluding\":\"8.5.2\",\"matchCriteriaId\":\"79229BE7-0AA0-4308-8BB2-8FB11E8B9AD7\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html\",\"source\":\"security@atlassian.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515\",\"source\":\"security@atlassian.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276\",\"source\":\"security@atlassian.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CONFSERVER-92475\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CONFSERVER-92475\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-92475\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T10:13:48.693Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-22515\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2023-12-09T05:05:17.297744Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2023-10-05\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515\"}}}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-13T18:01:01.747Z\"}}], \"cna\": {\"credits\": [{\"lang\": \"en\", \"value\": \"an Atlassian customer\"}], \"metrics\": [{\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"Atlassian\", \"product\": \"Confluence Data Center\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"\u003c 8.0.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.1.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.1.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.3.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.3.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.3.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.4.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.4.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.4.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.1\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.3.3\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.4.3\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.5.2\"}]}, {\"vendor\": \"Atlassian\", \"product\": \"Confluence Server\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"\u003c 8.0.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.1.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.1.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.3.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.3.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.3.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.4.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.4.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.4.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.1\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.3.3\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.4.3\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.5.2\"}]}], \"references\": [{\"url\": \"http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html\"}, {\"url\": \"https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515\"}, {\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276\"}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-92475\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. \\r\\n\\r\\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"BASM (Broken Authentication \u0026 Session Management)\", \"description\": \"BASM (Broken Authentication \u0026 Session Management)\"}]}], \"providerMetadata\": {\"orgId\": \"f08a6ab8-ed46-4c22-8884-d911ccfe3c66\", \"shortName\": \"atlassian\", \"dateUpdated\": \"2023-10-20T16:00:01.026Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-22515\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-25T14:56:37.404Z\", \"dateReserved\": \"2023-01-01T00:01:22.331Z\", \"assignerOrgId\": \"f08a6ab8-ed46-4c22-8884-d911ccfe3c66\", \"datePublished\": \"2023-10-04T14:00:00.820Z\", \"assignerShortName\": \"atlassian\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.