CVE-2023-22515
Atlassian has been made aware of an issue reported by a handful of customers where external...
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- Record
CVE-2023-22515- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-26655
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- Record
EUVD-2023-26655- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g458-xvmc-qg2r
Atlassian has been made aware of an issue reported by a handful of customers where external...
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
For more details, please review the linked advisory on this CVE.
- Record
GHSA-g458-xvmc-qg2r- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CISA KEV No score
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
- Record
CVE-2023-22515- Updated
- 2026-11-02
NVD
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- Record
CVE-2023-22515- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Atlassian Confluence Unauthenticated Remote Code Execution | 2023-10-04 |
| PoC in GitHub | ErikWynter/CVE-2023-22515-Scan | 2023-10-06 |
| PoC in GitHub | Chocapikk/CVE-2023-22515 | 2023-10-10 |
| PoC in GitHub | j3seer/CVE-2023-22515-POC | 2023-10-10 |
| PoC in GitHub | ad-calcium/CVE-2023-22515 | 2023-10-11 |
| PoC in GitHub | kh4sh3i/CVE-2023-22515 | 2023-10-11 |
| PoC in GitHub | s1incere/CVE-2023-22515 | 2023-10-12 |
| PoC in GitHub | Le1a/CVE-2023-22515 | 2023-10-13 |
| PoC in GitHub | Vulnmachines/confluence-cve-2023-22515 | 2023-10-13 |
| PoC in GitHub | iveresk/CVE-2023-22515 | 2023-10-13 |
Show 18 moreShow less
Plus 6 more. The full list has every link.
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| exploits, exploits_more | ||
| exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-22515 is a critical vulnerability (CVSS 10.0) in Atlassian Confluence Data Center, published October 4, 2023. CISA lists it as known to be exploited, since October 5, 2023. EUVD reports exploitation since October 5, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.2%, the 99th percentile. No source names a fixed version.
References
packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html
confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515
jira.atlassian.com/browse/CONFSERVER-92475
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515
nvd.nist.gov/vuln/detail/CVE-2023-22515
github.com/advisories/GHSA-g458-xvmc-qg2r