Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Vulnerability record

CVE-2023-22515

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

CriticalExploitation confirmedCISA KEV Used by ransomware
What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Confluence Data Center and Server, fix it now.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.

US federal civilian agencies must remediate by Oct 13, 2023.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

ProductVendorAffected versionsFixed inSource
Confluence Data Center and ServerAtlassian——KEV
Confluence ServerAtlassian>= 8.0.0, < 8.3.3; >= 8.4.0, < 8.4.3; >= 8.5.0, < 8.5.28.3.3; 8.4.3; 8.5.2NVD

Sources: KEV = CISA Known Exploited Vulnerabilities catalog; NVD = NIST National Vulnerability Database.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdateKEV

    CVE-2023-22515 scored CVSS 9.8: Atlassian Confluence Data Center and Server, Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

    CISA lists this as exploited in the wild and known to be used in ransomware campaigns. Unpatched Confluence Data Center and Server systems are exposed to active attacks now.

    Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References