CVE-2023-22515: critical vulnerability in Atlassian Confluence Data Center
Published · Updated
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 10epss 99%
from disclosure to weapon2 days
Published on NVDOct 4
1st PoC+2d
metasploitOct 4
CISA KEV+1d
exploitation probability
99%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
53 public exploit(s)
Action required by CISAfederal deadline: 2023-10-13
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
In short
A critical vulnerability in Confluence Data Center and Server allows attackers to create unauthorized administrator accounts on publicly exposed instances, giving them full control over the system.
Technical detail
An improper input validation vulnerability (CWE-20) in Confluence Data Center and Server enables unauthenticated remote attackers to create malicious administrator accounts via a publicly accessible instance, bypassing authentication controls and leading to complete system compromise. Confluence Cloud instances are not affected.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
public PoCs found — 53
githubgithub.com/Chocapikk/CVE-2023-22515★ 153githubgithub.com/ad-calcium/CVE-2023-22515★ 110githubgithub.com/ErikWynter/CVE-2023-22515-Scan★ 79githubgithub.com/AIex-3/confluence-hack★ 52githubgithub.com/K4ptor/CVE-2023-22515★ 25githubgithub.com/aaaademo/Confluence-EvilJar★ 23githubgithub.com/youcannotseemeagain/CVE-2023-22515_RCE★ 20githubgithub.com/j3seer/CVE-2023-22515-POC★ 8githubgithub.com/Le1a/CVE-2023-22515★ 6githubgithub.com/kh4sh3i/CVE-2023-22515★ 5githubgithub.com/spareack/CVE-2023-22515-NSE★ 4githubgithub.com/Vulnmachines/confluence-cve-2023-22515★ 3githubgithub.com/LucasPDiniz/CVE-2023-22515★ 2githubgithub.com/fyx1t/NSE--CVE-2023-22515★ 2githubgithub.com/rxerium/CVE-2023-22515★ 1githubgithub.com/iveresk/CVE-2023-22515★ 1githubgithub.com/Arkha-Corvus/LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197★ 1githubgithub.com/C1ph3rX13/CVE-2023-22515★ 1githubgithub.com/DsaHen/cve-2023-22515-exp★ 0githubgithub.com/vivigotnotime/CVE-2023-22515-Exploit-Script★ 0githubgithub.com/edsonjt81/CVE-2023-22515-Scan.★ 0githubgithub.com/INTfinityConsulting/cve-2023-22515★ 0githubgithub.com/s1d6point7bugcrowd/CVE-2023-22515-check★ 0githubgithub.com/xorbbo/cve-2023-22515★ 0githubgithub.com/Onedy1703/CVE-2023-22515-Confluence★ 0githubgithub.com/tranphuc2005/CVE-2023-22515★ 0githubgithub.com/CyberSentinel321/cve-2023-22515-lab★ 0githubgithub.com/dkq-k/CVE-2023-22515★ 0githubgithub.com/dkq-k/cve-2023-22515-1★ 0vulncheckvulncheck.com/xdb/6b3485fb8287unverifiedvulncheckvulncheck.com/xdb/60c1f99992acunverifiedvulncheckvulncheck.com/xdb/cd9c98c483eeunverifiedvulncheckvulncheck.com/xdb/d75adb32bcb4unverifiedvulncheckvulncheck.com/xdb/b179feb841caunverifiedvulncheckvulncheck.com/xdb/c3834d7050f1unverifiedvulncheckvulncheck.com/xdb/dd10c7ed859eunverifiedvulncheckvulncheck.com/xdb/ce588e7e7050unverifiedvulncheckvulncheck.com/xdb/d1a7360ad4aaunverifiedvulncheckvulncheck.com/xdb/101896665425unverifiedvulncheckvulncheck.com/xdb/fa96709f1affunverifiedvulncheckvulncheck.com/xdb/a9f8f396455cunverifiedvulncheckvulncheck.com/xdb/63759da36933unverifiedvulncheckvulncheck.com/xdb/1476d745bdd8unverifiedvulncheckvulncheck.com/xdb/331998b69600unverifiedvulncheckvulncheck.com/xdb/2c6f91286eacunverifiedvulncheckvulncheck.com/xdb/4482a214bee0unverifiedvulncheckvulncheck.com/xdb/d52ac20466b2unverifiedvulncheckvulncheck.com/xdb/9c39f6bf800cunverifiedvulncheckvulncheck.com/xdb/bd7912683190unverifiedvulncheckvulncheck.com/xdb/62d32405c6daunverifiedcve_referencepacketstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/5ce1d4a47587unverifiedvulncheckvulncheck.com/xdb/2dea07330c59unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Atlassian Confluence Data Center
In the same product, most dangerous first.
References
http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.htmlhttps://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276https://jira.atlassian.com/browse/CONFSERVER-92475https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515