TI-2023-08757 Aliases CVE-2023-22515 GHSA-g458-xvmc-qg2r

Improper input validation in Atlassian Confluence Data Center

CRITICAL 100Exploited in the wildCWE-20Published 2023-10-04 · Updated 2026-03-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Why it matters now

Exploitation Active In CISA KEV since 2023-10-05CISA due date 2023-10-13Known ransomware use

EPSS 0.9923 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Confluence Data Center (Atlassian): < 8.0.0, >= 8.3.3, >= 8.4.3 +1Confluence Server (Atlassian): < 8.0.0, >= 8.3.3, >= 8.4.3 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Confluence Data Center	>= 8.0.0; >= 8.0.1; >= 8.0.2; >= 8.0.3; >= 8.1.3; >= 8.1.4; >= 8.2.0; >= 8.2.1; >= 8.2.2; >= 8.2.3; >= 8.3.0; >= 8.3.1; >= 8.3.2; >= 8.4.0; >= 8.4.1; >= 8.4.2; >= 8.5.0; >= 8.5.1	< 8.0.0, >= 8.3.3, >= 8.4.3, >= 8.5.2	Patch available	CNA
Atlassian	Confluence Server	>= 8.0.0; >= 8.0.1; >= 8.0.2; >= 8.0.3; >= 8.1.3; >= 8.1.4; >= 8.2.0; >= 8.2.1; >= 8.2.2; >= 8.2.3; >= 8.3.0; >= 8.3.1; >= 8.3.2; >= 8.4.0; >= 8.4.1; >= 8.4.2; >= 8.5.0; >= 8.5.1	< 8.0.0, >= 8.3.3, >= 8.4.3, >= 8.5.2	Patch available	CNA

Confluence Data Center VendorAtlassian Affected >= 8.0.0; >= 8.0.1; >= 8.0.2; >= 8.0.3; >= 8.1.3; >= 8.1.4; >= 8.2.0; >= 8.2.1; >= 8.2.2; >= 8.2.3; >= 8.3.0; >= 8.3.1; >= 8.3.2; >= 8.4.0; >= 8.4.1; >= 8.4.2; >= 8.5.0; >= 8.5.1 Fixed in < 8.0.0, >= 8.3.3, >= 8.4.3, >= 8.5.2 Patch available CNA
Confluence Server VendorAtlassian Affected >= 8.0.0; >= 8.0.1; >= 8.0.2; >= 8.0.3; >= 8.1.3; >= 8.1.4; >= 8.2.0; >= 8.2.1; >= 8.2.2; >= 8.2.3; >= 8.3.0; >= 8.3.1; >= 8.3.2; >= 8.4.0; >= 8.4.1; >= 8.4.2; >= 8.5.0; >= 8.5.1 Fixed in < 8.0.0, >= 8.3.3, >= 8.4.3, >= 8.5.2 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:confluence_data_center::::::::	8.0.0 to before 8.3.3; 8.4.0 to before 8.4.3; 8.5.0 to before 8.5.2	Vulnerable	Atlassian
cpe:2.3:a:atlassian:confluence_server::::::::	8.0.0 to before 8.3.3; 8.4.0 to before 8.4.3; 8.5.0 to before 8.5.2	Vulnerable	Atlassian

cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.3.3; 8.4.0 to before 8.4.3; 8.5.0 to before 8.5.2 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.3.3; 8.4.0 to before 8.4.3; 8.5.0 to before 8.5.2 Vulnerable ·Atlassian

Remediation

Fix · CNA Confluence Data Center (Atlassian) Fixed in < 8.0.0, >= 8.3.3, >= 8.4.3, >= 8.5.2
Fix · CNA Confluence Server (Atlassian) Fixed in < 8.0.0, >= 8.3.3, >= 8.4.3, >= 8.5.2

Timeline

2023-10-05 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2023-22515
2026-10-03 Alias added: GHSA-g458-xvmc-qg2r

References

Exploit 1

http://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html

Advisory 3

TI-2023-08765 Injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2022-09596 Expression language injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2021-08036 Expression language injection in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
TI-2023-08759 Incorrect authorization in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences