Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Confluence Data Center | < 8.0.0, >= 8.0.0, >= 8.0.1, >= 8.0.2, >= 8.0.3, >= 8.1.3, >= 8.1.4, >= 8.2.0, >= 8.2.1, >= 8.2.2, >= 8.2.3, >= 8.3.0, >= 8.3.1, >= 8.3.2, >= 8.4.0, >= 8.4.1, >= 8.4.2, >= 8.5.0, >= 8.5.1, >= 8.3.3, >= 8.4.3, >= 8.5.2 |
| Atlassian | Confluence Server | < 8.0.0, >= 8.0.0, >= 8.0.1, >= 8.0.2, >= 8.0.3, >= 8.1.3, >= 8.1.4, >= 8.2.0, >= 8.2.1, >= 8.2.2, >= 8.2.3, >= 8.3.0, >= 8.3.1, >= 8.3.2, >= 8.4.0, >= 8.4.1, >= 8.4.2, >= 8.5.0, >= 8.5.1, >= 8.3.3, >= 8.4.3, >= 8.5.2 |
Yes — actively exploited. Added to the CISA KEV catalog on 2023-10-05. Ransomware use: Known.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.