Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2023-10-04

CVE-2023-22515

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

  1. First PoC
  2. 929 days →Metasploit
  3. 178 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2023-10-05 · due 2023-10-13 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
99%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

34 known · links only

GitHub PoCs · by trust, then stars31

  1. Chocapikk/CVE-2023-22515 ↗Trust ok 100

    CVE-2023-22515: Confluence Broken Access Control Exploit

    ★ 153 · created 2023-10-10

  2. ad-calcium/CVE-2023-22515 ↗Trust ok 100

    Confluence未授权添加管理员用户(CVE-2023-22515)漏洞利用工具

    ★ 110 · created 2023-10-11

  3. ErikWynter/CVE-2023-22515-Scan ↗Trust ok 100

    Scanner for CVE-2023-22515 - Broken Access Control Vulnerability in Atlassian Confluence

    ★ 79 · created 2023-10-06

  4. AIex-3/confluence-hack ↗Trust ok 100

    CVE-2023-22515

    ★ 51 · created 2023-10-30

  5. s1incere/CVE-2023-22515 ↗Trust ok 100

    Confluence Unauthorized Administrator User Addition Exploitation Script

    ★ 25 · created 2023-10-12

  6. aaaademo/Confluence-EvilJar ↗Trust ok 100

    配合 CVE-2023-22515 后台上传jar包实现RCE

    ★ 23 · created 2023-11-09

  7. youcannotseemeagain/CVE-2023-22515_RCE ↗Trust ok 100

    Confluence后台rce

    ★ 19 · created 2023-10-20

  8. j3seer/CVE-2023-22515-POC ↗Trust ok 100

    Poc for CVE-2023-22515

    ★ 9 · created 2023-10-10

  9. kh4sh3i/CVE-2023-22515 ↗Trust ok 100

    CVE-2023-22515 - Broken Access Control Vulnerability in Confluence Data Center and Server

    ★ 6 · created 2023-10-11

  10. Le1a/CVE-2023-22515 ↗Trust ok 100

    Confluence Data Center & Server 权限提升漏洞 Exploit

    ★ 6 · created 2023-10-13

  11. spareack/CVE-2023-22515-NSE ↗Trust ok 100

    Vulnerability checking tool via Nmap Scripting Engine

    ★ 4 · created 2024-07-18

  12. fyx1t/NSE--CVE-2023-22515 ↗Trust ok 100

    NSE script for checking the presence of CVE-2023-22515

    ★ 2 · created 2024-04-26

  13. LucasPDiniz/CVE-2023-22515 ↗Trust ok 100

    Server Broken Access Control in Confluence - CVE-2023-22515

    ★ 2 · created 2023-11-08

  14. Vulnmachines/confluence-cve-2023-22515 ↗Trust ok 100

    Confluence Broken Access Control

    ★ 2 · created 2023-10-13

  15. C1ph3rX13/CVE-2023-22515 ↗Trust ok 100

    CVE-2023-22515

    ★ 1 · created 2023-10-27

  16. iveresk/CVE-2023-22515 ↗Trust ok 100

    iveresk-CVE-2023-22515

    ★ 1 · created 2023-10-13

  17. rxerium/CVE-2023-22515 ↗Trust ok 100

    Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

    ★ 1 · created 2024-02-24

  18. Borsch-Appreciator/SOC235---Atlassian-Confluence-Broken-Access-Control-0-Day-CVE-2023-22515 ↗Trust ok 100

    ★ 0 · created 2026-07-24

  19. CalegariMindSec/Exploit-CVE-2023-22515 ↗Trust ok 100

    A simple exploit for CVE-2023-22515

    ★ 0 · created 2024-01-02

  20. CyberSentinel321/cve-2023-22515-lab ↗Trust ok 100

    Hands-on security lab demonstrating CVE-2023-22515 — Atlassian Confluence Authentication Bypass using a simulated vulnerable environment.

    ★ 0 · created 2025-11-21

  21. dkq-k/CVE-2023-22515 ↗Trust ok 100

    ★ 0 · created 2026-01-16

  22. dkq-k/cve-2023-22515-1 ↗Trust ok 100

    ★ 0 · created 2026-01-16

  23. DsaHen/cve-2023-22515-exp ↗Trust ok 100

    cve-2023-22515的python利用脚本

    ★ 0 · created 2023-10-21

  24. edsonjt81/CVE-2023-22515-Scan. ↗Trust ok 100

    ★ 0 · created 2023-11-26

  25. INTfinityConsulting/cve-2023-22515 ↗Trust ok 100

    Confluence broken access control to code execution

    ★ 0 · created 2023-11-29

  26. killvxk/CVE-2023-22515-joaoviictorti ↗Trust ok 100

    CVE-2023-22515 (Confluence Broken Access Control Exploit)

    ★ 0 · created 2024-11-05

  27. Onedy1703/CVE-2023-22515-Confluence ↗Trust ok 100

    CVE 2023-22515

    ★ 0 · created 2024-07-21

  28. s1d6point7bugcrowd/CVE-2023-22515-check ↗Trust ok 100

    This script will inform the user if the Confluence instance is vulnerable, but it will not proceed with the exploitation steps.

    ★ 0 · created 2024-06-05

  29. tranphuc2005/CVE-2023-22515 ↗Trust ok 100

    ★ 0 · created 2025-09-06

  30. vivigotnotime/CVE-2023-22515-Exploit-Script ↗Trust ok 100

    ★ 0 · created 2025-02-24

  31. xorbbo/cve-2023-22515 ↗Trust ok 100

    NSE script to check if app is vulnerable to cve-2023-22515

    ★ 0 · created 2024-06-08

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit2

  1. Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control ↗

    This module exploits a broken access control vulnerability in Atlassian Confluence servers leading to an authentication bypass. A specially crafted request can be create new admin account without authentication on the target Atlassian server.

    ruby · seen 2026-10-18

  2. Atlassian Confluence Unauthenticated Remote Code Execution ↗

    This module exploits an improper input validation issue in Atlassian Confluence, allowing arbitrary HTTP parameters to be translated into getter/setter sequences via the XWorks2 middleware and in turn allows for Java objects to be modified at run time. The exploit will create a new administrator user and upload a malicious plugins to get arbitrary code execution. All versions of Confluence between 8.0.0 through to 8.3.2, 8.4.0 through to 8.4.2, and 8.5.0 t

    ruby · seen 2026-10-18

Nuclei1

  1. Atlassian Confluence - Privilege Escalation ↗

    Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.

    yaml · seen 2026-10-18

Detections

3 rules · Sigma · QRadar · Cortex

  1. CVE exploitation

    CVE-2023-22515 exploitation attempt

    CVE-2023-22515 · Storm-0062 · Ukrainian Cyber Alliance

    T1190conf 70SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.