CVE-2023-22515Used in ransomware
Atlassian Confluence Data Center and Server
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
What it is
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
Vendor notices and references
- confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-con
- nvd.nist.gov/vuln/detail/CVE-2023-22515
Description and required action as published by CISA. Full record at NVD.
Other Atlassian entries on the list
- Multiple Products Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CVE-2026-21589 · Oct 15, 2026
- Jira Server and Data Center Atlassian Jira Server and Data Center Path Traversal Vulnerability CVE-2021-26086 · Nov 12, 2024
- Confluence Data Center and Server Atlassian Confluence Data Center and Server Template Injection Vulnerability CVE-2023-22527 · Jan 24, 2024
- Confluence Data Center and Server Atlassian Confluence Data Center and Server Improper Authorization Vulnerability CVE-2023-22518 · Nov 7, 2023
- Bitbucket Server and Data Center Atlassian Bitbucket Server and Data Center Command Injection Vulnerability CVE-2022-36804 · Sep 30, 2022
- Confluence Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability CVE-2022-26138 · Jul 29, 2022