CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Description
CVE-2023-22515 is a critical improper input validation vulnerability in Atlassian Confluence Data Center and Server that allows unauthenticated remote attackers to create unauthorized administrator accounts and gain full access to Confluence instances. This broken access control flaw exploits a weakness in how Confluence handles certain setup-related requests, enabling attackers to bypass authentication entirely and escalate privileges to administrator level. The vulnerability carries a maximum CVSS v3.1 score of 9.8 (Critical) and has been actively exploited in the wild, prompting CISA to add it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 13, 2023. CVE-2023-22515 has been linked to ransomware campaigns, and its EPSS score of 94.3% indicates near-certain exploitation activity. Atlassian Cloud sites hosted on atlassian.net domains are not affected; only self-managed Confluence Data Center and Server instances are vulnerable.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| atlassian | confluence data center | >= 8.0.0, < 8.3.3; >= 8.4.0, < 8.4.3; >= 8.5.0, < 8.5.2 |
| atlassian | confluence server | >= 8.0.0, < 8.3.3; >= 8.4.0, < 8.4.3; >= 8.5.0, < 8.5.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515(Vendor Advisory)
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276(Vendor Advisory)
- https://jira.atlassian.com/browse/CONFSERVER-92475(Issue Tracking, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CWE-20 describes a weakness where the software does not validate or incorrectly validates input that can affect the control flow or data flow of a program. In CVE-2023-22515, Atlassian Confluence Data Center and Server fails to properly validate requests to certain setup endpoints, allowing unauthenticated attackers to manipulate application state and create administrator accounts without authorization.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2023-22515 carries a CVSS v3.1 score of 9.8 (Critical severity) and poses a severe risk to organizations running self-managed Atlassian Confluence instances. Attack Vector (Network): The vulnerability is remotely exploitable without physical access, targeting any publicly accessible Confluence Data Center or Server instance. Attack Complexity (Low): No special conditions or preparation are required to exploit this flaw. Privileges Required (None): An attacker needs no existing account or authentication to exploit the vulnerability. User Interaction (None): No action from a legitimate user is required. Confidentiality Impact (High): An attacker gains full administrative access to the Confluence instance, exposing all stored content including sensitive corporate documentation, intellectual property, and internal communications. Integrity Impact (High): With administrator privileges, an attacker can modify any content, install plugins, and alter system configurations. Availability Impact (High): The attacker could disrupt the entire Confluence service. The EPSS score of 94.3% confirms that exploitation is near-certain, and CISA has confirmed ransomware operators are using this vulnerability in their attack chains.
Exploit Maturity
Public exploit code is available for CVE-2023-22515 via Packet Storm Security, providing a proof-of-concept for unauthenticated remote code execution through the administrator account creation flaw. CISA has confirmed active exploitation in the wild and added CVE-2023-22515 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 13, 2023. Ransomware usage is confirmed — threat actors have incorporated this vulnerability into ransomware attack chains targeting Confluence servers. The EPSS score of 94.3% (99.95th percentile) indicates near-certain exploitation activity, underscoring the urgency of remediation for any exposed Confluence instance.
Remediation
- Apply Atlassian’s security patches immediately. Upgrade Confluence Data Center and Server to a patched version as specified in Atlassian’s advisory (CONFSERVER-92475). The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Audit for indicators of compromise. Review Confluence administrator accounts for any unauthorized or recently created accounts. Check Confluence access logs for suspicious requests to setup-related endpoints (e.g., paths). Remove any unauthorized administrator accounts immediately.
- Restrict network access to Confluence instances. Block public internet access to Confluence Data Center and Server instances using firewall rules or VPN requirements. Limit access to trusted internal networks and authorized IP ranges to reduce exposure.
- Monitor for unauthorized changes and suspicious activity. Enable detailed audit logging in Confluence and monitor for new administrator account creation, plugin installations, or configuration changes. Set up alerts for access from unfamiliar IP addresses or geographic locations.
- Implement long-term access control hardening. Enforce multi-factor authentication for all Confluence administrator accounts, regularly review and prune administrative privileges, and maintain an inventory of all publicly accessible Confluence instances to ensure rapid patching in the future.
Technical Details
CVE-2023-22515 exploits improper input validation in Atlassian Confluence Data Center and Server, specifically in how the application handles requests to setup and configuration endpoints. Attack Vector (Network): The attack is conducted remotely by sending crafted HTTP requests to a publicly accessible Confluence instance. Attack Complexity (Low): The exploit requires no special conditions — an attacker simply sends requests to specific endpoints that should only be accessible during initial setup. The vulnerability allows an unauthenticated attacker to invoke setup actions on an already-configured Confluence instance, bypassing the normal authentication and authorization controls. By exploiting this flaw, the attacker can create new administrator accounts with full privileges, effectively gaining complete control over the Confluence environment. The root cause lies in the failure to properly restrict access to sensitive setup endpoints after the initial installation is complete, falling under CWE-20 (Improper Input Validation). Once an attacker has administrator access, they can execute arbitrary code through Confluence’s built-in plugin system, escalating from a web application compromise to full server-level control.
Frequently Asked Questions
Is CVE-2023-22515 being actively exploited?
Yes, CVE-2023-22515 has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 13, 2023. Atlassian confirmed that external attackers exploited this vulnerability to create unauthorized administrator accounts on publicly accessible Confluence instances. Ransomware operators have also been confirmed to use this vulnerability in their attack chains.
What products are affected by CVE-2023-22515?
CVE-2023-22515 affects Atlassian Confluence Data Center and Confluence Server. Atlassian Cloud sites accessed via atlassian.net domains are not affected. Only self-managed, on-premises or self-hosted Confluence instances are vulnerable to this exploit.
How do I fix CVE-2023-22515?
Upgrade Confluence Data Center and Server to the latest patched version as specified in Atlassian’s security advisory (CONFSERVER-92475). Additionally, audit your Confluence instance for unauthorized administrator accounts, restrict public internet access to Confluence, and enable detailed audit logging. See the Remediation section above for complete steps.
How severe is CVE-2023-22515?
CVE-2023-22515 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It allows unauthenticated remote attackers to create administrator accounts and gain full control of Confluence instances. The EPSS score of 94.3% (99.95th percentile) indicates near-certain exploitation, and the vulnerability has been linked to ransomware campaigns, making immediate remediation essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.