CVE-2023-22515
Description
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
How to fix
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
CISA due date: Oct 13, 2023- atlassian confluence_data_center8.3.3, 8.4.3, 8.5.2 or later
- atlassian confluence_server8.3.3, 8.4.3, 8.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian confluence_data_center | 8.0.0 ≤ v < 8.3.3, 8.4.0 ≤ v < 8.4.3, 8.5.0 ≤ v < 8.5.2 | 8.3.3, 8.4.3, 8.5.2 |
| atlassian confluence_server | 8.0.0 ≤ v < 8.3.3, 8.4.0 ≤ v < 8.4.3, 8.5.0 ≤ v < 8.5.2 | 8.3.3, 8.4.3, 8.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.