Zero-day vulnerability in Confluence Data Center

Improper Authentication
CVE-2023-22515

Vulnerability details

Advisory: SB2023100515 - Remote code execution in Confluence Data Center and Server

Vulnerable component: Confluence Data Center

CVE-ID: CVE-2023-22515

CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

CWE-ID: CWE-287 - Improper Authentication

Description:

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authentication at the "/setup/setupadministrator.action" endpoint. A remote non-authenticated attacker can send specially crafted requests to the server to create an administrative account and gain unauthorized access to the system.

Note, the vulnerability is being actively exploited in the wild.

Public Exploits:

- Atlassian Confluence Data Center and Server - Authentication Bypass (Metasploit) [Exploit-DB]

External links:

https://jira.atlassian.com/browse/CONFSERVER-92475

About zero-day vulnerabilities

Zero-day vulnerability is an undisclosed vulnerability in software that hackers can exploit to compromise computer programs, gain unauthorized access to sensitive data, penetrate networks, etc. We consider vulnerability a zero-day when there is no solution provided from software vendor and the vulnerability is being actively exploited by malicious actors.

Zero-day candidate is a potential zero-day vulnerability in software which might have been used in targeted attacks, however there is no evidence to support this suggestion.