ClosedPatched
Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)
Atlassian Confluence Data Center and Server
A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.
Why this severity: CVSS 10.0 (Atlassian), zero-day, actively exploited (CISA KEV), known ransomware use
- Started
- Oct 4, 2023
- Closed
- Oct 16, 2023
Affected
- 8.0.0 to 8.5.1 (Atlassian advisory)
Fixed in
- 8.3.3
- 8.4.3
- 8.5.2 (LTS)
Updates by day3
Advisories4
- CVE-2023-22515 - Broken Access Control Vulnerability in Confluence Data Center and ServerAtlassian · Oct 4, 2023
- Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks (AA23-289A)CISA · Oct 16, 2023
- NVD: CVE-2023-22515NVD
- CISA Known Exploited Vulnerabilities CatalogCISA · Oct 5, 2023
Notes & caveats
Storm-0062 attribution per Microsoft Threat Intelligence (exploitation since Sept 14, 2023).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
