CVE-2023-22515 is a critical vulnerability identified in Atlassian Confluence Data Center and Server. This vulnerability, classified as a broken access control issue, allows remote attackers to exploit publicly accessible Confluence instances to create unauthorized Confluence administrator accounts. Once an attacker gains administrative access, they can perform a wide range of malicious activities, including exfiltrating content, accessing system credentials, and installing malicious plugins.
The vulnerability does not affect Atlassian Cloud sites. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue. The vulnerability has a CVSS score of 10, indicating its critical nature. The attack vector is network-based, requiring no authentication and low complexity, making it highly exploitable.
The issue was reported by a handful of customers and has been actively exploited in the wild. Attackers have leveraged this zero-day vulnerability to gain unauthorized access to Confluence instances, leading to significant security breaches. The vulnerability affects Confluence Data Center and Server versions prior to 8.0.0.
Atlassian has provided several updates and advisories to address this issue. They recommend upgrading to the latest fixed versions of Confluence Data Center and Server to mitigate the risk. Additionally, Atlassian has provided threat detection support and reinforced the actions required to secure affected instances. Organizations are advised to work with their local security teams or specialist security forensics firms for further investigation and to contact Atlassian Support for additional assistance.
| 