Atlassian · Confluence Data Center and Server
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
What it is
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CISA: Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
Deadline for US federal agencies: October 13, 2023
- Added to the CISA list
- October 5, 2023
- Published
- October 4, 2023
- Severity
- Critical 10.0 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- 99.2% in the top 0.1% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (4)
More exploited flaws from Atlassian
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jan 24, 2024 | Template Injection | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Nov 7, 2023 | Improper Authorization | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Oct 15, 2026 | Files or Directories Accessible to External Parties | Multiple Products | Critical 9.3 | 99.5% |
| Nov 12, 2024 | Path Traversal | Jira Server and Data Center | Medium 5.3 | >99.9% |
| Sep 30, 2022 | Command Injection | Bitbucket Server and Data Center | High 8.8 | 99.1% |
| Jul 29, 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Critical 9.8 | 98% |
| Jun 2, 2022 | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | Critical 9.8 | >99.9% |
| Mar 28, 2022 | Pre-Authorization Arbitrary File Read | Confluence Server | Medium 5.3 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.