blog

Critical Vulnerabilities in Atlassian Confluence: Zero-Day Exploits targeting CVE-2023-21715, Application Security, and Nation-State Threats

Atlassian Confluence
Critical Vulnerability
Zero-Day Exploit
Application Security
Nation-State
CVE-2023-22515
Security Patch
Data Center
Server

Atlassian Confluence is a cornerstone for every developer; CISA has recently announced that Confluence, a popular tool for documentation and application security, has recently been under the spotlight due to a series of critical vulnerabilities CVE-2023-21715 in particular. With nation-state actors increasingly exploiting zero-day vulnerabilities, it’s crucial to stay updated. This blog post aims to answer key questions about some of the most recent vulnerabilities affecting Atlassian Confluence. Atlassian has released an advisory for CVE-2023-22515

—-

Previous Issues of Vulnerability Weekly

—-

What is the CVE-2023-21715 Vulnerability?

CVE-2023-22515 is a critical zero-day vulnerability affecting publicly exposed instances of Confluence Data Center and Server from version 8 on.

A remote, unauthenticated attacker could exploit this privilege escalation to create unauthorized Confluence administrator accounts and access Confluence servers. Exploitation does not require user interaction and is easy to execute.
The confidentiality, integrity and availability of information are impacted to the highest degree.

Atlassian Confluence vulnerabilities refer to security flaws in the Confluence Data Center and Server that can be exploited to gain unauthorized access see vulnerabilities part of your Application Security program, manipulate data, or perform other malicious activities. These vulnerabilities are often critical and require immediate attention.

How Secure is Atlassian Confluence?

Atlassian Confluence is generally considered secure, and reliable for application security, with robust application security measures in place. However, like any software, it is not immune to defects, especially zero-day exploits that are often targeted by nation-state actors.

What is the Latest Vulnerability in Confluence?

This is a critical issue that allows the unauthorized creation of administrator accounts in publicly accessible Confluence instances.

How widespread is this vulnerability CVE-2023-21715?

Shodan currently displays more than 1000 systems across organizations mostly in the USA let’s explore more details on the critical issue

For this critical CVE

CVE- 10/9.8
CTI – 1.1 (low)

EPSS – Very High – 0.935270000

Exploit – Confirmed

Actors – Nation-state

Type: Privilege Escalation

Zero-Day Exploit
Nation-State
CVE-2023-22515
Vulnerable Versions
Security Patch
Data Center
Server

Currently, there are two streams of attackers on Graynoise divided into a group of 5 and 6 malicious actors but the growing

Graynoise, Atlassian Confluence
Critical Vulnerability
Zero-Day Exploit
Application Security
Nation-State
CVE-2023-22515
Vulnerable Versions
Security Patch
Data Center
Server

graynoise 2 Confluence
Zero-Day Exploit
Nation-State
CVE-2023-22515
Vulnerable Versions
Security Patch
Data Center
Server
Graynoise

Credit Graynoise intelligence

What are the Vulnerable Versions of Confluence for CVE-2023-21715?

CVE-2023-22515 affects Confluence Data Center and Server versions 8.0.0 to 8.5.1. It’s crucial to upgrade to the latest versions to mitigate risks.

Affected Versions CVE-2023-21715

The Confluence Data Center and Server versions listed below are affected by this vulnerability. Customers using these versions should upgrade your instance as soon as possible.

Versions prior to 8.0.0 are not affected by this issue.

Product	Affected Versions
Confluence Data Center and Confluence Server	8.0.08.0.18.0.28.0.38.0.48.1.08.1.18.1.38.1.48.2.08.2.18.2.28.2.38.3.08.3.18.3.28.4.08.4.18.4.28.5.08.5.1

Fixed Versions CVE-2023-21715

Atlassian recommends that you upgrade each of your affected installations to one of the listed fixed versions (or any later version) below.

Product	Fixed Versions
Confluence Data Center and Confluence Server	8.3.3 or later8.4.3 or later8.5.2 (Long Term Support release) or later

Mitigations

One of the mitigations below will prove effective.

Restrict external network access to the vulnerable instance
Bring the vulnerable instance offline
1. Block access to the /setup/* endpoints on Confluence instances. This is possible at the network layer or by making the following changes to Confluence configuration files.On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>

<web-resource-collection>

<url-pattern>/setup/*</url-pattern>

<http-method-omission>*</http-method-omission>

</web-resource-collection>

<auth-constraint />

</security-constraint>

2. Restart Confluence.

How can Phoenix security help with CVE-2023-22515

Nation-State
CVE-2023-22515
Vulnerable Versions
Phoenix Security

When it comes to identifying which of your systems are exposed to critical vulnerabilities like CVE-2023-22515, Phoenix Security offers a single query and pane of glass for all the risky assets.

Analyse the vulnerability in the phoenix security vulnerability screen and Infrastructure screen to identify which system has been compromised (note since the time of publishing the image the EPSS has changed)

Our advanced vulnerability and infrastructure screens are designed to quickly identify systems that are externally facing, making it easier for you to take immediate action. By analyzing the CVE-2023-22515 vulnerability in both the vulnerability and infrastructure screens, Phoenix Security provides a comprehensive view of your risk landscape. This enables you to prioritize patches and other security measures effectively, ensuring that your Atlassian Confluence instances remain secure against zero-day exploits and nation-state threats.

Previous Issues of Vulnerability Weekly

0 Days Vulnerability

0 Days Vulnerability

Francesco Cipollone

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

12th October 2023

vuln_weekly vulnerabilities vulnerability zeroday

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Announcing Phoenix Threat Centric Approach

Learn how to predict ransomware risks and vulnerability exploitation using a threat-centric approach. Explore data-driven insights, verified exploit trends, and methods for assessing the likelihood of attacks with key references to CISA KEV, EPSS, and Phoenix Security’s 4D Risk Formula.

Francesco Cipollone

A Threat-Centric Look at Vulnerability Exploitation Likelihood and Ransomware Risk

Remote Code Execution flaws continue to undermine Kubernetes ingress integrity. IngressNightmare (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974) showcases severe threat vectors in NGINX-based proxies, leading to cluster-wide exposure. ASPM, robust remediation tactics, and strong application security solutions—like Phoenix Security—mitigate these vulnerabilities before ransomware groups exploit them.

Francesco Cipollone

IS NGINX IngressNightmare bad? Bad news it is: Critical Remote Code Execution Threats (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974)

Francesco Cipollone

Google Bought Wiz for $32B. Now What? Why Is It Great for the Security Market?

The recent Google acquisition of Wiz for $32 billion has sent shockwaves through the cybersecurity industry, particularly in the realm of Application Security Posture Management (ASPM). This monumental deal highlights the critical importance of cloud security and the growing demand for robust ASPM solutions. While the acquisition promises potential benefits for Google Cloud users, it also raises concerns about vendor lock-in and the future of cloud-agnostic security. Explore the implications of this acquisition and discover how neutral ASPM solutions like Phoenix Security can bridge the gap in multi-cloud environments, ensuring continuous, collaborative, and comprehensive security from code to cloud.” – Find Assets/Vulns by Scanner – Detailed findings Location information Risk-based Posture Management – Risk and Risk Magnitude for Assets – Filter assets and vulnerabilities by source scanner Integrations – BurpSuite XML Import – Assessment Import API Other Improvements – Improved multi-selection in filters – New CVSS Score column in Vulnerabilities

Alfonso Eusebio

Phoenix Security Features – March 2025

The team at Phoenix Security pleased to bring you another set of new application security (ASPM) features and improvements for vulnerability management across application and cloud security engines. This release builds on top of previous releases with key additions and progress across multiple areas of the platform. Application Security Posture Management (ASPM) Enhancements • New Weighted Asset Risk Formula – Refined risk aggregation for tailored vulnerability management. • Auto-Approval of Risk Exceptions – Accelerate mitigation by automating security approvals. • Enhanced Risk Explorer & Business Unit Insights – Monitor and analyze risk exposure by business units for better prioritization. Vulnerability & Asset Management • Link Findings to Existing Tickets – Seamless GitHub, ServiceNow, and Azure DevOps integration. • Multi-Finding Ticketing for ADO – Group multiple vulnerabilities in a single ticket for better workflow management. • Filter by Business Unit, CWE, Ownership, and Deployment Environment – Target vulnerabilities with precision using advanced filtering. Cyber Threat Intelligence & Security Enhancements • Cyber Threat Intelligence Premium – Access 128,000+ exploits for better exploitability and fixability metrics. • SBOM, Container SBOM & Open Source Artifact Analysis – Conduct deep security analysis with reachability insights. • Enhanced Lacework Container Management – Fetch and analyze running container details for better security reporting. • REST API Enhancements – Use asset tags for automated deployments and streamline security processes. Other Key Updates • CVE & CWE Columns Added – Compare vulnerabilities more effectively. • Custom Status Management for Findings – Personalize security workflows with custom status configurations. • Impact & Risk Explorer Side Panel – Gain heatmap-based insights into vulnerability distribution and team risk impact. 🚀 Stay ahead of vulnerabilities, optimize risk assessment, and enhance security efficiency with Phoenix Security’s latest features! 🚀

Alfonso Eusebio

CVE-2025-30066 tj-actions/changed-files GitHub Action Compromise: Impacts on Software Supply Chain Security and ASPM

Discover CVE-2025-30066 tj-actions/changed-files GitHub Action has been compromised, exposing secrets in CI/CD pipelines and posing a major software supply chain security risk. Attackers injected malicious code into all versions (V1–V45), repointing existing tags to a compromised commit that exfiltrated credentials via GitHub Actions logs. Immediate remediation is required—organizations must scan their repositories, rotate secrets, and replace the action to mitigate risk. Learn how Phoenix Security’s ASPM can automate threat detection and enhance GitHub Actions security.

Francesco Cipollone

blog

Critical Vulnerabilities in Atlassian Confluence: Zero-Day Exploits targeting CVE-2023-21715, Application Security, and Nation-State Threats

Previous Issues of Vulnerability Weekly

What is the CVE-2023-21715 Vulnerability?

How Secure is Atlassian Confluence?

What is the Latest Vulnerability in Confluence?

How widespread is this vulnerability CVE-2023-21715?