#VU81631 Improper Authentication in Confluence Data Center - CVE-2023-22515
Published: October 5, 2023 / Updated: February 25, 2025
Vulnerability identifier: #VU81631
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2023-22515
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Confluence Data Center
Confluence Data Center
Software vendor:
Atlassian
Atlassian
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing authentication at the "/setup/setupadministrator.action" endpoint. A remote non-authenticated attacker can send specially crafted requests to the server to create an administrative account and gain unauthorized access to the system.
Note, the vulnerability is being actively exploited in the wild.
Remediation
Install updates from vendor's website.
External links
- https://jira.atlassian.com/browse/CONFSERVER-92457
- https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276
- https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html