CVE-2023-22515

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa💥 Exploit

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 99%
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 5/10/2023
Plazo de remediación: 13/10/2023
Uso conocido en ransomware: Known

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Módulo de Metasploit (exploit fiable y al alcance de cualquiera) · Atlassian Confluence Unauthenticated Remote Code Execution
Plantilla de Nuclei (detección automática y masiva) · Atlassian Confluence - Privilege Escalation
Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1098.001 Additional Cloud Credentialspersistence · privilege escalation90 %

Vulnerabilidad en aplicación expuesta (Confluence público) explotada para crear cuentas admin no autorizadas (T1098.001) y obtener acceso como usuario privilegiado (T1078.001). CVSS crítico (C:H/I:H/A:H) y uso activo en ransomware confirman impacto de ejecución de comandos (T1059.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Network Segmentation Vulnerability Scanning User Account Management Multi-factor Authentication Limit Access to Resource Over Network

Tecnologías afectadas (2)

Atlassian — Confluence Data Center Atlassian — Confluence Server

CWE

NVD-CWE-noinfo
CWE-20

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2023-22515",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-22515",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2023-12-09T05:05:17.297744Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@atlassian.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Confluence Data Center",
          "versions": [
            {
              "status": "unaffected",
              "version": "< 8.0.0"
            },
            {
              "status": "affected",
              "version": ">= 8.0.0"
            },
            {
              "status": "affected",
              "version": ">= 8.0.1"
            },
            {
              "status": "affected",
              "version": ">= 8.0.2"
            },
            {
              "status": "affected",
              "version": ">= 8.0.3"
            },
            {
              "status": "affected",
              "version": ">= 8.1.3"
            },
            {
              "status": "affected",
              "version": ">= 8.1.4"
            },
            {
              "status": "affected",
              "version": ">= 8.2.0"
            },
            {
              "status": "affected",
              "version": ">= 8.2.1"
            },
            {
              "status": "affected",
              "version": ">= 8.2.2"
            },
            {
              "status": "affected",
              "version": ">= 8.2.3"
            },
            {
              "status": "affected",
              "version": ">= 8.3.0"
            },
            {
              "status": "affected",
              "version": ">= 8.3.1"
            },
            {
              "status": "affected",
              "version": ">= 8.3.2"
            },
            {
              "status": "affected",
              "version": ">= 8.4.0"
            },
            {
              "status": "affected",
              "version": ">= 8.4.1"
            },
            {
              "status": "affected",
              "version": ">= 8.4.2"
            },
            {
              "status": "affected",
              "version": ">= 8.5.0"
            },
            {
              "status": "affected",
              "version": ">= 8.5.1"
            },
            {
              "status": "unaffected",
              "version": ">= 8.3.3"
            },
            {
              "status": "unaffected",
              "version": ">= 8.4.3"
            },
            {
              "status": "unaffected",
              "version": ">= 8.5.2"
            }
          ]
        },
        {
          "vendor": "Atlassian",
          "product": "Confluence Server",
          "versions": [
            {
              "status": "unaffected",
              "version": "< 8.0.0"
            },
            {
              "status": "affected",
              "version": ">= 8.0.0"
            },
            {
              "status": "affected",
              "version": ">= 8.0.1"
            },
            {
              "status": "affected",
              "version": ">= 8.0.2"
            },
            {
              "status": "affected",
              "version": ">= 8.0.3"
            },
            {
              "status": "affected",
              "version": ">= 8.1.3"
            },
            {
              "status": "affected",
              "version": ">= 8.1.4"
            },
            {
              "status": "affected",
              "version": ">= 8.2.0"
            },
            {
              "status": "affected",
              "version": ">= 8.2.1"
            },
            {
              "status": "affected",
              "version": ">= 8.2.2"
            },
            {
              "status": "affected",
              "version": ">= 8.2.3"
            },
            {
              "status": "affected",
              "version": ">= 8.3.0"
            },
            {
              "status": "affected",
              "version": ">= 8.3.1"
            },
            {
              "status": "affected",
              "version": ">= 8.3.2"
            },
            {
              "status": "affected",
              "version": ">= 8.4.0"
            },
            {
              "status": "affected",
              "version": ">= 8.4.1"
            },
            {
              "status": "affected",
              "version": ">= 8.4.2"
            },
            {
              "status": "affected",
              "version": ">= 8.5.0"
            },
            {
              "status": "affected",
              "version": ">= 8.5.1"
            },
            {
              "status": "unaffected",
              "version": ">= 8.3.3"
            },
            {
              "status": "unaffected",
              "version": ">= 8.4.3"
            },
            {
              "status": "unaffected",
              "version": ">= 8.5.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-10-04T14:15:10.440",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-92475",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://confluence.atlassian.com/display/KB/FAQ+for+CVE-2023-22515",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1295682276",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-92475",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22515",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. \r\n\r\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue."
    },
    {
      "lang": "es",
      "value": "Atlassian ha sido informado de un problema informado por un puñado de clientes en el que atacantes externos pueden haber explotado una vulnerabilidad previamente desconocida en instancias de Confluence Data Center and Server de acceso público para crear cuentas de administrador de Confluence no autorizadas y acceder a instancias de Confluence. Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a través de un dominio atlassian.net, está alojado en Atlassian y no es vulnerable a este problema."
    }
  ],
  "lastModified": "2026-06-17T05:35:37.127",
  "cisaActionDue": "2023-10-13",
  "cisaExploitAdd": "2023-10-05",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85B2AD9F-CBA6-4559-9AE3-5F76A9EC3B7F",
              "versionEndExcluding": "8.3.3",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38F9918D-6848-4CD6-8096-4FB48C23818B",
              "versionEndExcluding": "8.4.3",
              "versionStartIncluding": "8.4.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D646BCF-214F-449D-AEEB-B253E8715394",
              "versionEndExcluding": "8.5.2",
              "versionStartIncluding": "8.5.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "970A3DA7-5114-4696-A93D-C3D5AFF5C6C5",
              "versionEndExcluding": "8.3.3",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2EB19CD-AE29-4775-91C5-05B01A96AC6C",
              "versionEndExcluding": "8.4.3",
              "versionStartIncluding": "8.4.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79229BE7-0AA0-4308-8BB2-8FB11E8B9AD7",
              "versionEndExcluding": "8.5.2",
              "versionStartIncluding": "8.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.",
  "cisaVulnerabilityName": "Atlassian Confluence Data Center and Server Broken Access Control Vulnerability"
}