# CVE-2023-22515: Atlassian Confluence - RCE

> Live exploitation tracking for CVE-2023-22515 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-22515

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Atlassian Confluence Server
- **Weaknesses:** CWE-20 (Improper Input Validation)
- **Tags:** enterprise_software, wiki

## Description

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. 

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

## CrowdSec analysis

[CVE-2023-22515](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-22515) is a critical vulnerability in Atlassian Confluence Data Center and Server that allows remote attackers to create unauthorized administrator accounts, potentially granting full control over affected Confluence instances.

CrowdSec has been tracking this vulnerability and its exploits since 6th of October 2023.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2023-22515 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-22515 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-22515 is currently experiencing high visibility and active exploitation across the internet.

Attack patterns are focused on identifying and exploiting publicly accessible instances, rather than those hosted under the atlassian.net domain.

## Timeline

- 2023-10-04: CVE Published. CVE-2023-22515 is published to NVD.
- 2023-10-05: CISA KEV. CVE-2023-22515 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2023-10-06: Rule Released. CrowdSec releases a rule to detect CVE-2023-22515 exploitation attempts against the CrowdSec Network.
- 2023-10-06: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-22515 for the first time.
- 2023-10-13: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://jira.atlassian.com/browse/CONFSERVER-92475
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22515.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-22515) follows observed exploitation activity for CVE-2023-22515. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.