[HIGH PRIORITY] Atlassian Confluence Broken Access Control (CVE-2023-22515)

⚠ HIGH PRIORITY — CISA KEV. CVE-2023-22515 is a broken access control flaw in Atlassian Confluence Data Center and Server. Unauthenticated attackers create admin accounts and take over Confluence on Linux Tomcat hosts — often chained before CVE-2023-22527 exploitation.

Affected Confluence

• Confluence 8.0.0 through 8.5.1
• Self-hosted wiki on port 8090/443
• Instances without IP restriction on /setup path

Check for compromise

curl -s http://confluence:8090/status
grep -R 'confluence.version' /opt/atlassian/confluence/

Patching Method

1. Backup Confluence home and database immediately.
2. Upgrade to Confluence 8.5.2+ via Atlassian installer or download upgrade JAR from Atlassian security advisory.
3. On Linux: /opt/atlassian/confluence/bin/stop-confluence.sh, apply upgrade, start-confluence.sh.
4. Review User management for unknown admin accounts.
5. Delete suspicious users; force password reset for all admins.
6. Block external access until patched and audited.

# Audit admin users in Confluence DB (PostgreSQL example)
sudo -u postgres psql confluence -c "SELECT user_name, created_date FROM cwd_user ORDER BY created_date DESC LIMIT 10;"

Workaround

• Restrict Confluence to internal VPN only
• Block /setup/ paths at reverse proxy
• Enable SAML/SSO with MFA after patch