CVE-2023-22515
10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Atlassian | Confluence Data Center | < 8.0.0 | unaffected |
| Atlassian | Confluence Data Center | >= 8.0.0 | affected |
| Atlassian | Confluence Data Center | >= 8.0.1 | affected |
| Atlassian | Confluence Data Center | >= 8.0.2 | affected |
| Atlassian | Confluence Data Center | >= 8.0.3 | affected |
| Atlassian | Confluence Data Center | >= 8.1.3 | affected |
| Atlassian | Confluence Data Center | >= 8.1.4 | affected |
| Atlassian | Confluence Data Center | >= 8.2.0 | affected |
| Atlassian | Confluence Data Center | >= 8.2.1 | affected |
| Atlassian | Confluence Data Center | >= 8.2.2 | affected |
| Atlassian | Confluence Data Center | >= 8.2.3 | affected |
| Atlassian | Confluence Data Center | >= 8.3.0 | affected |
| Atlassian | Confluence Data Center | >= 8.3.1 | affected |
| Atlassian | Confluence Data Center | >= 8.3.2 | affected |
| Atlassian | Confluence Data Center | >= 8.4.0 | affected |
| Atlassian | Confluence Data Center | >= 8.4.1 | affected |
| Atlassian | Confluence Data Center | >= 8.4.2 | affected |
| Atlassian | Confluence Data Center | >= 8.5.0 | affected |
| Atlassian | Confluence Data Center | >= 8.5.1 | affected |
| Atlassian | Confluence Data Center | >= 8.3.3 | unaffected |
| Atlassian | Confluence Data Center | >= 8.4.3 | unaffected |
| Atlassian | Confluence Data Center | >= 8.5.2 | unaffected |
| Atlassian | Confluence Server | < 8.0.0 | unaffected |
| Atlassian | Confluence Server | >= 8.0.0 | affected |
| Atlassian | Confluence Server | >= 8.0.1 | affected |
| Atlassian | Confluence Server | >= 8.0.2 | affected |
| Atlassian | Confluence Server | >= 8.0.3 | affected |
| Atlassian | Confluence Server | >= 8.1.3 | affected |
| Atlassian | Confluence Server | >= 8.1.4 | affected |
| Atlassian | Confluence Server | >= 8.2.0 | affected |
| Atlassian | Confluence Server | >= 8.2.1 | affected |
| Atlassian | Confluence Server | >= 8.2.2 | affected |
| Atlassian | Confluence Server | >= 8.2.3 | affected |
| Atlassian | Confluence Server | >= 8.3.0 | affected |
| Atlassian | Confluence Server | >= 8.3.1 | affected |
| Atlassian | Confluence Server | >= 8.3.2 | affected |
| Atlassian | Confluence Server | >= 8.4.0 | affected |
| Atlassian | Confluence Server | >= 8.4.1 | affected |
| Atlassian | Confluence Server | >= 8.4.2 | affected |
| Atlassian | Confluence Server | >= 8.5.0 | affected |
| Atlassian | Confluence Server | >= 8.5.1 | affected |
| Atlassian | Confluence Server | >= 8.3.3 | unaffected |
| Atlassian | Confluence Server | >= 8.4.3 | unaffected |
| Atlassian | Confluence Server | >= 8.5.2 | unaffected |
Weaknesses
- BASM (Broken Authentication & Session Management)
ADP Enrichment
CVE Program Container
Additional References
- http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html
- https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276
- https://jira.atlassian.com/browse/CONFSERVER-92475
CISA ADP Vulnrichment
- SSVC:
- Exploitation: active
- Automatable: yes
- Technical Impact: total
Additional References
References
- http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html
- https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276
- https://jira.atlassian.com/browse/CONFSERVER-92475
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.