10

CVE-2023-22515: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

KEVRansomware
Analyzed
Published 04-10-2023Last modified 25-03-2026

Vulnerability summary

CVE-2023-22515 is a critical (CVSS 10.0) Improper Input Validation vulnerability in Atlassian Confluence Data Center and Server. It is known to be exploited: CISA and ENISA list it, first on 05-10-2023. It has been used in ransomware campaigns. EPSS estimates a 99.22% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded. Fixed in 8.3.3, 8.4.3, 8.5.2.

Priority
Act nowransomware

Known ransomware use (ENISA, 23-01-2025)

Source freshness unavailable

How is this decided?
CVSS score
10.0/10
010
Critical · v3.0 (CVE.org)
EPSS score
99.22%
0%100%
Critical · +0.07 pp in 30 days
KEVExploited in the wildCritical · listed in 2 catalogs
RansomwareKnown useFlagged by CISA, ENISA
Public exploits3reference, metasploit

Timeline

  1. 04-10-2023
    PublishedVulnerability first disclosed.
  2. 05-10-2023
    Added to CISA KEVExploitedAtlassian Confluence Data Center and Server Broken Access Control Vulnerability
  3. 13-10-2023
    CISA remediation dueDeadline passedApply mitigations per vendor instructions.
  4. 23-01-2025
    Added to ENISA KEVExploitedAdded to the ENISA known exploited vulnerabilities catalog.
  5. 25-03-2026
    Last modifiedVulnerability information updated.

Description

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

99.22%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

Increase +0.07 pp

From 99.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
05-10-2023
Federal due date
13-10-2023
Ransomware
ENISA CNWListed
Added
23-01-2025
Ransomware
CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA. confluence.atlassian.com/security/… nvd.nist.gov/vuln/detail/CVE-2023-22515

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • MetasploitMetasploitremoteUnverified

    Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control

    auxiliary/admin/http/atlassian_confluence_auth_bypass

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Atlassian Confluence Unauthenticated Remote Code Execution

    exploit/multi/http/atlassian_confluence_rce_cve_2023_22515

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian2 products
  • confluence_data_center≥ 8.0.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.0.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.0.2 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.0.3 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.1.3 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.1.4 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.2.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.2.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.2.2 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.2.3 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.3.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.3.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.3.2 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.4.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.4.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.4.2 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.5.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.5.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.0.0, < 8.3.3 | ≥ 8.4.0, < 8.4.3 | ≥ 8.5.0, < 8.5.2
  • confluence_server≥ 8.0.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.0.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.0.2 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.0.3 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.1.3 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.1.4 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.2.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.2.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.2.2 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.2.3 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.3.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.3.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.3.2 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.4.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.4.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.4.2 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.5.0 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.5.1 (fixed in 8.3.3, 8.4.3, 8.5.2) | ≥ 8.0.0, < 8.3.3 | ≥ 8.4.0, < 8.4.3 | ≥ 8.5.0, < 8.5.2

1 vendor · 2 products

References

5 links