cve.bz

CVE-2023-22515

9.8 criticalKEVEPSS 99%

Critical (9.8) in Atlassian Confluence Data Center and Server. In CISA KEV since 2023-10-05, with known ransomware use. EPSS 99% chance of exploitation in the next 30 days.

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2023-10-05, due 2023-10-13, known ransomware use
CWE
CWE-20
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON