Exploit / PoCcriticalExploited in the wild

Atlassian Confluence zero-day CVE-2023

Security Affairsby @securityaffairsOct 4, 2023 · 19:46 UTC (Oct 4, 2023)2 min read2 · 1 read

Read at securityaffairs.com

Analyze CVE-2023-22515 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2023-22515 CVE-2022-26134

Tags: cve-2023-22515 cve-2022-26134 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2022-26134	Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center	9.8	100%	KEVRansomwarePoC ×2	Jun 3, 2022 KEV Jun 2, 2022
CVE-2023-22515	Unauthenticated Broken Access Control in Atlassian Confluence Data Center/Server	9.8	99%	KEVRansomwarePoC	Oct 4, 2023 KEV Oct 5, 2023

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
domain	atlassian.net	oud sites. If customer’s Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to

From the original article

2 min read at securityaffairs.com

Atlassian fixed a critical zero-day flaw in its Confluence Data Center and Server software, which has been exploited in the wild. Software giant Atlassian released emergency security updates to address a critical zero-day vulnerability, tracked as CVE-2023-22515 (CVSS score 10), in its Confluence Data Center and Server software.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.