Article
CVE-2023-22515: Atlassian Confluence Zero-Day | Actively Exploited
CVE-2023-22515 lets attackers create admin accounts in Atlassian Confluence 8.0.0 to 8.5.1. See affected and fixed versions, CVSS and how to respond.
Read more
Exploited vulnerability
Confluence broken access control (CVE-2023-22515)
CVE-2023-22515
CVE-2023-22515 is a broken access control flaw in Atlassian Confluence Data Center and Server.
- On CISA KEV
- CVE ID
- CVE-2023-22515
- CISA KEV
- Listed
- Affected product
- Confluence Data Center and Server
- Exploited
- Yes
- Published
- October 2023
In short
CVE-2023-22515 is a broken access control flaw in Atlassian Confluence Data Center and Server. It lets an attacker with no login create unauthorized administrator accounts. CISA, the FBI and MS-ISAC issued joint advisory AA23-289A on it in October 2023, saying it was exploited as a zero-day.
- CVECVE-2023-22515
- ProductAtlassian Confluence Data Center and Server
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade Confluence · Look for signs of compromise
What it allows
An unauthenticated remote attacker can change the Confluence server's configuration to say setup is not complete, then use the setup administrator endpoint to create a new administrator. Atlassian says an attacker with full administrative access can steal content and credentials and install malicious plugins.
Who is affected
Atlassian lists Confluence Data Center and Server 8.0.0 up to 8.5.1. Versions before 8.0.0 are not affected, and Atlassian Cloud sites (atlassian.net) are not affected. The fixed versions are 8.3.3, 8.4.3 and 8.5.2 (Long Term Support), or later.
Atlassian said a handful of customers reported attackers creating administrator accounts on publicly accessible instances, and later said it had evidence that a known nation-state actor was exploiting the flaw. Atlassian released a patch on 4 October 2023. CISA added CVE-2023-22515 to the Known Exploited Vulnerabilities catalog on 5 October 2023.
In advisory AA23-289A, CISA, the FBI and MS-ISAC state that the flaw was exploited as a zero-day, meaning before a fix existed, and that exploitation continued after the patch. They expected widespread exploitation of unpatched instances and noted public proof-of-concept exploits as of 10 October 2023. The catalog marks known ransomware campaign use as Known.
Who exploits it
What to do
-
Upgrade Confluence
Upgrade to 8.3.3, 8.4.3 or 8.5.2 (Long Term Support) or later, as Atlassian recommends. CISA, the FBI and MS-ISAC say to upgrade immediately.
-
Restrict access, or block the setup endpoints
Atlassian says to restrict external network access until you can upgrade. As an interim measure it describes blocking the /setup/* endpoints at the network layer or in the web.xml file. This does not replace upgrading.
-
Look for signs of compromise
Atlassian lists unexpected members of the confluence-administrators group, new user accounts, unknown plugins, and requests to /setup/*.action in access logs.
-
Report findings as CISA asks
CISA's catalog says to check all affected instances for evidence of compromise and report positive findings to CISA.
Questions
What is CVE-2023-22515?
CVE-2023-22515 is a broken access control flaw in Atlassian Confluence Data Center and Server. An unauthenticated remote attacker can create a new administrator account through the setup administrator endpoint.
Which Confluence versions are affected by CVE-2023-22515?
Atlassian lists Confluence Data Center and Server 8.0.0 up to 8.5.1. Versions before 8.0.0 and Atlassian Cloud sites are not affected. Fixed versions are 8.3.3, 8.4.3 and 8.5.2 (Long Term Support), or later.
Was CVE-2023-22515 exploited as a zero-day?
Yes. CISA, the FBI and MS-ISAC state in AA23-289A that it was exploited as a zero-day, before a fix existed, and that exploitation continued after the patch. CISA added it to its KEV catalog on 5 October 2023.
Has CVE-2023-22515 been used in ransomware?
The catalog marks known ransomware campaign use as Known, and the page lists the RansomHub ransomware as a service operation among the groups that exploit it.
In our research
- CVE-2023-22515: Atlassian Confluence Zero-Day | Actively Exploited October 2023
- Vulnerability and Malware Trends of 2022 January 2023
Sources
- CVE-2023-22515 Broken Access Control in Confluence Data Center and Server Atlassian
- AA23-289A Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks CISA, FBI and MS-ISAC
- NVD entry CVE-2023-22515 NIST National Vulnerability Database
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.