# CVE-2023-22515

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

- Page: https://www.vulneraibility.com/cve/CVE-2023-22515
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2023-10-05; CISA due date 2023-10-13; known ransomware use
- EPSS: 99.23% (percentile 99.9)
- Public exploit code: 2 Metasploit modules · 31 GitHub proofs of concept · 1 Nuclei template (first 2023-10-06)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2023-12-09)
- Weakness: CWE-20
- Published: 2023-10-04

## Affected versions

- Atlassian Confluence Data Center: affected >= 8.0.0; >= 8.0.1; >= 8.0.2; >= 8.0.3; >= 8.1.3; >= 8.1.4; >= 8.2.0; >= 8.2.1; >= 8.2.2; >= 8.2.3; >= 8.3.0; >= 8.3.1; >= 8.3.2; >= 8.4.0; >= 8.4.1; >= 8.4.2; >= 8.5.0; >= 8.5.1; fixed in < 8.0.0, >= 8.3.3, >= 8.4.3, >= 8.5.2
- Atlassian Confluence Server: affected >= 8.0.0; >= 8.0.1; >= 8.0.2; >= 8.0.3; >= 8.1.3; >= 8.1.4; >= 8.2.0; >= 8.2.1; >= 8.2.2; >= 8.2.3; >= 8.3.0; >= 8.3.1; >= 8.3.2; >= 8.4.0; >= 8.4.1; >= 8.4.2; >= 8.5.0; >= 8.5.1; fixed in < 8.0.0, >= 8.3.3, >= 8.4.3, >= 8.5.2

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html
- [other] https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515
- [other] https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276
- [other] https://jira.atlassian.com/browse/CONFSERVER-92475
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.