← Retour aux CVEs
CVE-2023-22515
CRITICALCISA KEV9.8
Description
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Details CVE
Score CVSS v3.19.8
SeveriteCRITICAL
Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vecteur d'attaqueNETWORK
ComplexiteLOW
Privileges requisNONE
Interaction utilisateurNONE
Publie10/4/2023
Derniere modification3/25/2026
Sourcekev
Observations honeypot0
CISA KEV
FournisseurAtlassian
ProduitConfluence Data Center and Server
Nom vulnerabiliteAtlassian Confluence Data Center and Server Broken Access Control Vulnerability
Date ajout KEV2023-10-05
Date limite remediation2023-10-13
Utilise dans ransomwareKnown
Produits affectes
atlassian:confluence_data_centeratlassian:confluence_server
Faiblesses (CWE)
CWE-20
References
http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html(security@atlassian.com)
https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515(security@atlassian.com)
https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276(security@atlassian.com)
https://jira.atlassian.com/browse/CONFSERVER-92475(security@atlassian.com)
http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)
https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515(af854a3a-2127-422b-91ae-364da2661108)
https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276(af854a3a-2127-422b-91ae-364da2661108)
https://jira.atlassian.com/browse/CONFSERVER-92475(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515(134c704f-9b21-4f2e-91b3-4a467353bcc0)
Correlations IOC
Aucune correlation enregistree
This product uses data from the NVD API but is not endorsed or certified by the NVD.