CVE-2023-22515

Vulnerability updated 5 months ago (2024-05-04T19:07:20.755Z)
Download STIX
Preview STIX
CVE-2023-22515 is a critical Broken Access Control vulnerability discovered in October 2023, affecting the Confluence Data Center and Server. This flaw in software design or implementation allowed unauthenticated attackers to create unauthorized administrator accounts and gain access to Confluence instances. The vulnerability underscored persistent security issues and was exploited in the wild before being patched, highlighting its severity and potential for misuse. This zero-day vulnerability was exploited by various threat actors, including a China-sponsored advanced persistent threat (APT) group known as Storm-0062, prior to the release of a patch. In addition to CVE-2023-22515, cybersecurity company Rapid7 observed attacks targeting another vulnerability, CVE-2023-22518, an authentication bypass issue. These exploits against internet-exposed Atlassian Confluence servers emphasized the urgency for effective countermeasures. In response to these threats, several advisories were issued urging rapid patching of Atlassian Confluence servers. In particular, US agencies urged customers to patch this critical broken authentication & session management bug. Atlassian rolled out security fixes for this maximum-severity Remote Code Execution (RCE) bug, which had been exploited before patching. Check Point IPS also provided protection against this threat, further reinforcing the importance of timely updates and robust security measures.
Description last updated: 2024-03-17T13:16:58.818Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Atlassian
Confluence
Vulnerability
Zero Day
Apt
CISA
Fbi
Exploit
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Trigona Malware is associated with CVE-2023-22515. Trigona was a significant strain of ransomware that emerged in 2022, known for its harmful effects on computer systems. The malware infiltrated systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it could steal personal information, disrupt opeUnspecified
3
Source Document References
Information about the CVE-2023-22515 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CISA
a month ago
Securityaffairs
2 months ago
Securityaffairs
2 months ago
Securityaffairs
10 months ago
Securityaffairs
3 months ago
Securityaffairs
3 months ago
Securityaffairs
3 months ago
Securityaffairs
3 months ago
Securityaffairs
3 months ago
Securityaffairs
3 months ago
Securityaffairs
4 months ago
Securityaffairs
4 months ago
Securityaffairs
5 months ago
Securityaffairs
5 months ago
Securityaffairs
6 months ago
Securityaffairs
6 months ago
Securityaffairs
6 months ago
Securityaffairs
6 months ago
Securityaffairs
7 months ago
Securityaffairs
7 months ago