CVE-2023-22515

criticalpriority · act · 90OT risk · criticalKEV · exploitedEU KEV · CNWEPSS 0.992 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 33 exploits · weaponized

Likely / severe?

99.2% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

65 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2023-10-05remediate by 2023-10-13

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.

EU KEVflagged by CNWreported 2025-01-23patched 2023-10-04ransomware

Vulnerability in publicly accessible Confluence Data Center and Server instances that enables the creation of unauthorized Confluence administrator accounts and access to a Confluence instance

EPSS · scored 2026-10-24

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.010criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.010criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · security@atlassian.comexploitability 3.9 · impact 6

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-284US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (33)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/atlassian_confluence_rce_cve_2023_22515Atlassian Confluence Unauthenticated Remote Code Executionweaponized · metasploit
auxiliary/admin/http/atlassian_confluence_auth_bypassAtlassian Confluence Data Center and Server Authentication Bypass via Broken Access Controlfunctional · metasploit
AIex-3/confluence-hackCVE-2023-22515PoC · poc_in_github
Borsch-Appreciator/SOC235---Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515Borsch-Appreciator/SOC235---Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515PoC · poc_in_github
C1ph3rX13/CVE-2023-22515CVE-2023-22515PoC · poc_in_github
CalegariMindSec/Exploit-CVE-2023-22515A simple exploit for CVE-2023-22515PoC · poc_in_github

affected products (65)

Products and version ranges known to be affected.

Atlassian Bamboo < 9.2.7all versionscert_bundDEcpe:/a:atlassian:bamboo:9.2.7
Atlassian Bamboo < 9.3.5all versionscert_bundDEcpe:/a:atlassian:bamboo:9.3.5
Atlassian Bitbucket < 7.21.18all versionscert_bundDEcpe:/a:atlassian:bitbucket:7.21.18
Atlassian Bitbucket < 8.11.6all versionscert_bundDEcpe:/a:atlassian:bitbucket:8.11.6
Atlassian Bitbucket < 8.12.4all versionscert_bundDEcpe:/a:atlassian:bitbucket:8.12.4
Atlassian Bitbucket < 8.13.3all versionscert_bundDEcpe:/a:atlassian:bitbucket:8.13.3
Atlassian Bitbucket < 8.14.2all versionscert_bundDEcpe:/a:atlassian:bitbucket:8.14.2
Atlassian Bitbucket < 8.9.7all versionscert_bundDEcpe:/a:atlassian:bitbucket:8.9.7
Atlassian Confluence < 7.19.17all versionscert_bundDEcpe:/a:atlassian:confluence:7.19.17
Atlassian Confluence < 8.3.4all versionscert_bundDEcpe:/a:atlassian:confluence:8.3.4
Atlassian Confluence < 8.4.5all versionscert_bundDEcpe:/a:atlassian:confluence:8.4.5
Atlassian Confluence < 8.5.4all versionscert_bundDEcpe:/a:atlassian:confluence:8.5.4
Atlassian Confluence < 8.6.2all versionscert_bundDEcpe:/a:atlassian:confluence:8.6.2
Atlassian Confluence < 8.7.1all versionscert_bundDEcpe:/a:atlassian:confluence:8.7.1
Atlassian Jira Software < 9.4.13all versionscert_bundDEcpe:/a:atlassian:jira_software:9.4.13
Atlassian Jira Software Service Management < 4.20.28all versionscert_bundDEcpe:/a:atlassian:jira_software:service_management__4.20.28
Atlassian Jira Software Service Management < 5.4.12all versionscert_bundDEcpe:/a:atlassian:jira_software:service_management__5.4.12
Atlassian Confluence Data Center≤ 8.1.4enisa_euvdEU
Atlassian Confluence Data Center≤ 8.2.1enisa_euvdEU
Atlassian Confluence Data Center≤ 8.4.2enisa_euvdEU

showing 20 of 65

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-2555Atlassian Confluence Data Center and Server: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2023-10-04csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Atlassian Confluence ausnutzen, um seine Privilegien zu erhöhen.
WID-SEC-W-2023-2700Atlassian Confluence: Mehrere SchwachstellenDeutsch2023-10-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Confluence, Atlassian Jira Software, Atlassian Bitbucket und Atlassian Bamboo ausnutzen, um Administratorrechte zu erlangen, Informationen offenzulegen, beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2023-10-04modified 2026-06-17

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan