CVE-2023-22515criticalbajo ataqueransomwareCWE-20

CVE-2023-22515: fallo crítico en Atlassian Confluence Data Center

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Confluence Server+ Monitorear Confluence Data Center

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.

ssvc Actcvss 10epss 99%
de la publicación al arma2 días
Publicada en NVD4 oct
1ª PoC+2d
metasploit4 oct
CISA KEV+1d
Acción exigida por CISAplazo federal: 2023-10-13

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.

En resumen

Una vulnerabilidad crítica en Confluence Data Center y Server permite que atacantes creen cuentas de administrador no autorizadas en instancias expuestas públicamente, obteniendo control total del sistema.

Detalle técnico

Una vulnerabilidad de validación impropia de entrada (CWE-20) en Confluence Data Center y Server permite que atacantes no autenticados creen cuentas de administrador maliciosas a través de una instancia públicamente accesible, eludiendo controles de autenticación y resultando en comprometimiento completo del sistema. Las instancias Confluence Cloud no se ven afectadas.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Atlassian · Confluence Data CenterAtlassian · Confluence Server
PoCs públicas encontradas — 57
githubgithub.com/Chocapikk/CVE-2023-22515★ 153githubgithub.com/ad-calcium/CVE-2023-22515★ 110githubgithub.com/ErikWynter/CVE-2023-22515-Scan★ 79githubgithub.com/AIex-3/confluence-hack★ 52githubgithub.com/K4ptor/CVE-2023-22515★ 25githubgithub.com/aaaademo/Confluence-EvilJar★ 23githubgithub.com/youcannotseemeagain/CVE-2023-22515_RCE★ 20githubgithub.com/j3seer/CVE-2023-22515-POC★ 8githubgithub.com/Le1a/CVE-2023-22515★ 6githubgithub.com/kh4sh3i/CVE-2023-22515★ 5githubgithub.com/spareack/CVE-2023-22515-NSE★ 4githubgithub.com/Vulnmachines/confluence-cve-2023-22515★ 3githubgithub.com/LucasPDiniz/CVE-2023-22515★ 2githubgithub.com/fyx1t/NSE--CVE-2023-22515★ 2githubgithub.com/rxerium/CVE-2023-22515★ 1githubgithub.com/Arkha-Corvus/LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515-EventID-197★ 1githubgithub.com/C1ph3rX13/CVE-2023-22515★ 1githubgithub.com/iveresk/CVE-2023-22515★ 1githubgithub.com/INTfinityConsulting/cve-2023-22515★ 0githubgithub.com/vivigotnotime/CVE-2023-22515-Exploit-Script★ 0githubgithub.com/DsaHen/cve-2023-22515-exp★ 0githubgithub.com/edsonjt81/CVE-2023-22515-Scan.★ 0githubgithub.com/s1d6point7bugcrowd/CVE-2023-22515-check★ 0githubgithub.com/xorbbo/cve-2023-22515★ 0githubgithub.com/Onedy1703/CVE-2023-22515-Confluence★ 0githubgithub.com/tranphuc2005/CVE-2023-22515★ 0githubgithub.com/CyberSentinel321/cve-2023-22515-lab★ 0githubgithub.com/dkq-k/CVE-2023-22515★ 0githubgithub.com/dkq-k/cve-2023-22515-1★ 0vulncheckvulncheck.com/xdb/fe7569a790f6no verificadovulncheckvulncheck.com/xdb/2dea07330c59no verificadovulncheckvulncheck.com/xdb/6b3485fb8287no verificadovulncheckvulncheck.com/xdb/3de39597fdf1no verificadovulncheckvulncheck.com/xdb/60c1f99992acno verificadovulncheckvulncheck.com/xdb/cd9c98c483eeno verificadovulncheckvulncheck.com/xdb/d75adb32bcb4no verificadovulncheckvulncheck.com/xdb/b179feb841cano verificadovulncheckvulncheck.com/xdb/c3834d7050f1no verificadovulncheckvulncheck.com/xdb/dd10c7ed859eno verificadovulncheckvulncheck.com/xdb/ce588e7e7050no verificadovulncheckvulncheck.com/xdb/d1a7360ad4aano verificadovulncheckvulncheck.com/xdb/101896665425no verificadovulncheckvulncheck.com/xdb/fa96709f1affno verificadovulncheckvulncheck.com/xdb/a9f8f396455cno verificadovulncheckvulncheck.com/xdb/63759da36933no verificadovulncheckvulncheck.com/xdb/1476d745bdd8no verificadovulncheckvulncheck.com/xdb/331998b69600no verificadovulncheckvulncheck.com/xdb/2c6f91286eacno verificadovulncheckvulncheck.com/xdb/4482a214bee0no verificadovulncheckvulncheck.com/xdb/d52ac20466b2no verificadovulncheckvulncheck.com/xdb/33e9267dc7ebno verificadocve_referencepacketstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/9c39f6bf800cno verificadovulncheckvulncheck.com/xdb/bd7912683190no verificadovulncheckvulncheck.com/xdb/9cc8203f625eno verificadovulncheckvulncheck.com/xdb/62d32405c6dano verificadovulncheckvulncheck.com/xdb/5ce1d4a47587no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Atlassian Confluence Data Center

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-22518CRITICALCVE-2023-22518EPSS 100.0%KEVCVE-2022-26134CRITICALCVE-2022-26134EPSS 100.0%KEVCVE-2021-26084CRITICALCVE-2021-26084EPSS 100.0%KEVCVE-2023-22527CRITICALCVE-2023-22527EPSS 100.0%KEVCVE-2021-26085MEDIUMCVE-2021-26085EPSS 99.9%KEVCVE-2019-3396CRITICALCVE-2019-3396EPSS 99.9%KEV