A critical zero-day vulnerability in Atlassian Confluence Data Center and Server has been exploited in the wild in a limited number of cases. Organizations should patch or apply the mitigation steps as soon as possible.

CVE-2023-22515: Zero-Day Vulnerability in Atlassian Confluence Data Center and Server Exploited in the Wild

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Atlassian is a popular target and with PoC code and known exploitation for CVE-2023-22515, immediate remediation is recommended.

The Atlassian Confluence Server running on the remote host has a confirmed vulnerability as referenced in the CONFSERVER-92475 advisory.
  - Privilege Escalation in Confluence Data Center and Server - CVE-2023-22515 (CVE-2023-22515)

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 8.x prior to 8.3.3, 8.4.x prior to 8.4.3 or 8.5.x prior to 8.5.2. It is, therefore, affected by a privilege escalation vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-92475 advisory.

  - Privilege Escalation in Confluence Data Center and Server - CVE-2023-22515 (CVE-2023-22515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
182969	Atlassian Confluence 8.x < 8.3.3 / 8.4.x < 8.4.3 / 8.5.x < 8.5.2 (CONFSERVER-92475) (Direct Check)	Nessus	CGI abuses	critical
114058	Atlassian Confluence 8.5.x < 8.5.2 Privilege Escalation	Web App Scanning	Component Vulnerability	critical
114057	Atlassian Confluence 8.4.x < 8.4.3 Privilege Escalation	Web App Scanning	Component Vulnerability	critical
114056	Atlassian Confluence 8.x < 8.3.3 Privilege Escalation	Web App Scanning	Component Vulnerability	critical
182550	Atlassian Confluence 8.x < 8.3.3 / 8.4.x < 8.4.3 / 8.5.x < 8.5.2 (CONFSERVER-92475)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2023-22515

critical

Tenable Plugins

critical

critical

critical

critical

critical