Vulnerability Description
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Confluence Data Center | >= 8.0.0, < 8.3.3 |
| Atlassian | Confluence Server | >= 8.0.0, < 8.3.3 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/175225/Atlassian-Confluence-UnauthenticatedExploitThird Party AdvisoryVDB Entry
- https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515Vendor Advisory
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276Vendor Advisory
- https://jira.atlassian.com/browse/CONFSERVER-92475Issue TrackingVendor Advisory
- http://packetstormsecurity.com/files/175225/Atlassian-Confluence-UnauthenticatedExploitThird Party AdvisoryVDB Entry
- https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515Vendor Advisory
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276Vendor Advisory
- https://jira.atlassian.com/browse/CONFSERVER-92475Issue TrackingVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-US Government Resource
FAQ
What is CVE-2023-22515?
CVE-2023-22515 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Cente...
How severe is CVE-2023-22515?
CVE-2023-22515 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-22515?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Confluence Data Center, Atlassian Confluence Server.