VDB

GSD-2023-22515

GSD-2023-22515 PUBLISHED CVSS 10 CRITICAL

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Risk Scores

CVSS v3.0
10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
AtlassianConfluence Data Center*, >= 8.0.2, >= 8.0.3
AtlassianConfluence Server< 8.0.0, >= 8.0.0, >= 8.0.1

Timeline

  • Oct 5, 2023 PoC Published
  • Oct 5, 2023 PoC Published
  • Oct 19, 2023 PoC Published
  • Oct 19, 2023 PoC Published
  • Sep 16, 2024 PoC Published
  • Oct 15, 2024 PoC Published
  • Oct 24, 2024 PoC Published
  • Oct 25, 2024 PoC Published
  • Oct 26, 2024 PoC Published
  • Oct 27, 2024 PoC Published
  • Oct 28, 2024 PoC Published
  • Oct 29, 2024 PoC Published

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›