{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "confluence",
    "label": "Confluence",
    "isStack": false,
    "url": "https://pwn.watch/t/confluence",
    "feed": "https://pwn.watch/t/confluence/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "atlassian-confluence-data-center-and-server-cve-2023-22527",
      "title": "Atlassian Confluence Data Center and Server Template Injection",
      "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527",
      "json": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Atlassian Confluence Data Center and Server",
      "tags": [
        "java",
        "atlassian",
        "confluence",
        "cisa-kev",
        "ransomware",
        "rce"
      ],
      "cveIds": [
        "CVE-2023-22527"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-16",
      "closedAt": "2024-01-24",
      "updatedAt": "2024-01-24",
      "summary": "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. Added to the CISA KEV catalog on 2024-01-24. CISA lists known use in ransomware campaigns. CVE-2023-22527 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "title": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion",
      "json": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Cloudflare internal Atlassian environment",
      "tags": [
        "cloudflare",
        "okta",
        "atlassian",
        "confluence",
        "secrets"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-11-14",
      "closedAt": "2024-02-01",
      "updatedAt": "2024-02-01",
      "summary": "A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.",
      "xPost": null
    },
    {
      "slug": "atlassian-confluence-improper-authorization-cve-2023-22518",
      "title": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)",
      "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518",
      "json": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Atlassian Confluence Data Center and Server",
      "tags": [
        "java",
        "atlassian",
        "confluence",
        "auth-bypass",
        "ransomware",
        "cerber",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-22518"
      ],
      "affectedVersions": [
        "All versions of Confluence Data Center and Server before the fixed releases (NVD)"
      ],
      "fixedVersions": [
        "7.19.16",
        "8.3.4",
        "8.4.4",
        "8.5.3",
        "8.6.1"
      ],
      "startedAt": "2023-10-31",
      "closedAt": "2023-11-07",
      "updatedAt": "2023-11-07",
      "summary": "An improper authorization bug let unauthenticated attackers reset Confluence Data Center and Server and create a new admin. Within days of disclosure it was exploited to deploy Cerber ransomware. Atlassian Cloud was not affected.",
      "xPost": null
    },
    {
      "slug": "atlassian-confluence-admin-creation-cve-2023-22515",
      "title": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515",
      "json": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Atlassian Confluence Data Center and Server",
      "tags": [
        "java",
        "atlassian",
        "confluence",
        "zero-day",
        "auth-bypass",
        "china",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-22515"
      ],
      "affectedVersions": [
        "8.0.0 to 8.5.1 (Atlassian advisory)"
      ],
      "fixedVersions": [
        "8.3.3",
        "8.4.3",
        "8.5.2 (LTS)"
      ],
      "startedAt": "2023-10-04",
      "closedAt": "2023-10-16",
      "updatedAt": "2023-10-16",
      "summary": "A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-02-01",
      "title": "Cloudflare publishes its full write-up",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527",
      "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-24",
      "title": "CISA added CVE-2023-22527 to the KEV catalog (federal deadline 2024-02-14)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527"
    },
    {
      "incident": "atlassian-confluence-data-center-and-server-cve-2023-22527",
      "incidentTitle": "Atlassian Confluence Data Center and Server Template Injection",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-16",
      "title": "CVE-2023-22527 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-22527",
      "url": "https://pwn.watch/i/atlassian-confluence-data-center-and-server-cve-2023-22527"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-23",
      "title": "Cloudflare detects the attacker on its self-hosted Atlassian server",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "cloudflare-thanksgiving-2023-okta-token-intrusion",
      "incidentTitle": "Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-14",
      "title": "Attacker begins reconnaissance with credentials from the Okta compromise",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/thanksgiving-2023-security-incident",
      "url": "https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion"
    },
    {
      "incident": "atlassian-confluence-improper-authorization-cve-2023-22518",
      "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-07",
      "title": "CISA adds CVE-2023-22518 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518"
    },
    {
      "incident": "atlassian-confluence-improper-authorization-cve-2023-22518",
      "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-06",
      "title": "Atlassian raises the CVSS score to 10 after active exploitation and Cerber ransomware deployments",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518"
    },
    {
      "incident": "atlassian-confluence-improper-authorization-cve-2023-22518",
      "incidentTitle": "Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-31",
      "title": "Atlassian discloses CVE-2023-22518 and ships fixes",
      "body": null,
      "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html",
      "url": "https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-16",
      "title": "CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-05",
      "title": "CISA adds CVE-2023-22515 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-04",
      "title": "Atlassian discloses the zero-day after customer reports and ships fixes",
      "body": null,
      "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    }
  ]
}