CVE-2023-22503mediumCWE-200

CVE-2023-22503: medium-severity vulnerability in Atlassian Confluence Server

Published · Updated

Follow this CVE+ Monitor Confluence Server+ Monitor Confluence Data Center

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.8%
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team. The affected versions are before version 7.13.15, from version 7.14.0 before 7.19.7, and from version 7.20.0 before 8.2.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Atlassian · Confluence Data CenterAtlassian · Confluence Server
Related CVEs — Atlassian Confluence Server

In the same product, most dangerous first.

CVE-2023-22518CRITICALCVE-2023-22518EPSS 100.0%KEVCVE-2022-26134CRITICALCVE-2022-26134EPSS 100.0%KEVCVE-2021-26084CRITICALCVE-2021-26084EPSS 100.0%KEVCVE-2023-22527CRITICALCVE-2023-22527EPSS 100.0%KEVCVE-2021-26085MEDIUMCVE-2021-26085EPSS 99.9%KEVCVE-2019-3396CRITICALCVE-2019-3396EPSS 99.9%KEV