Risk | Critical |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2023-22515 |
CWE-ID | CWE-287 |
Exploitation vector | Network |
Public exploit | This vulnerability is being exploited in the wild. |
Vulnerable software |
Confluence Data Center Server applications / Other server solutions |
Vendor | Atlassian |
Security Bulletin
This security bulletin contains one critical risk vulnerability.
EUVDB-ID: #VU81631
Risk: Critical
CVSSv3.1: 9.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]
CVE-ID: CVE-2023-22515
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing authentication at the "/setup/setupadministrator.action" endpoint. A remote non-authenticated attacker can send specially crafted requests to the server to create an administrative account and gain unauthorized access to the system.
Note, the vulnerability is being actively exploited in the wild.
Install updates from vendor's website.
Vulnerable software versionsConfluence Data Center: 8.0.0 - 8.5.1
CPE2.3http://jira.atlassian.com/browse/CONFSERVER-92457
http://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515
http://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276
http://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.