Riskcovery

CVE-2023-22515

State
Published
Severity
10.0 Critical
Published
Oct 4, 2023
Updated
Mar 25, 2026
Reserved
Jan 1, 2023

Read the record on cve.org

Description

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Scores

CVSSScoreVectorSource
3.010.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hatlassian

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
Confluence Data CenterAtlassian
  • < 8.0.0Not affected
  • >= 8.0.0Affected
  • >= 8.0.1Affected
  • >= 8.0.2Affected
  • >= 8.0.3Affected
  • >= 8.1.3Affected
  • >= 8.1.4Affected
  • >= 8.2.0Affected
  • >= 8.2.1Affected
  • >= 8.2.2Affected
  • >= 8.2.3Affected
  • >= 8.3.0Affected
  • >= 8.3.1Affected
  • >= 8.3.2Affected
  • >= 8.4.0Affected
  • >= 8.4.1Affected
  • >= 8.4.2Affected
  • >= 8.5.0Affected
  • >= 8.5.1Affected
  • >= 8.3.3Not affected
  • >= 8.4.3Not affected
  • >= 8.5.2Not affected
Confluence ServerAtlassian
  • < 8.0.0Not affected
  • >= 8.0.0Affected
  • >= 8.0.1Affected
  • >= 8.0.2Affected
  • >= 8.0.3Affected
  • >= 8.1.3Affected
  • >= 8.1.4Affected
  • >= 8.2.0Affected
  • >= 8.2.1Affected
  • >= 8.2.2Affected
  • >= 8.2.3Affected
  • >= 8.3.0Affected
  • >= 8.3.1Affected
  • >= 8.3.2Affected
  • >= 8.4.0Affected
  • >= 8.4.1Affected
  • >= 8.4.2Affected
  • >= 8.5.0Affected
  • >= 8.5.1Affected
  • >= 8.3.3Not affected
  • >= 8.4.3Not affected
  • >= 8.5.2Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.