Critical Vulnerabilities in Atlassian Confluence: Zero-Day Exploits targeting CVE-2023-21715, Application Security, and Nation-State Threats

Atlassian Confluence Critical Vulnerability Zero-Day Exploit Application Security Nation-State CVE-2023-22515 Vulnerable Versions Security Patch Data Center Server
Atlassian Confluence
Critical Vulnerability
Zero-Day Exploit
Application Security
Nation-State
CVE-2023-22515
Security Patch
Data Center
Server

Atlassian Confluence is a cornerstone for every developer; CISA has recently announced that Confluence, a popular tool for documentation and application security, has recently been under the spotlight due to a series of critical vulnerabilities CVE-2023-21715 in particular. With nation-state actors increasingly exploiting zero-day vulnerabilities, it’s crucial to stay updated. This blog post aims to answer key questions about some of the most recent vulnerabilities affecting Atlassian Confluence. Atlassian has released an advisory for CVE-2023-22515

—-

Previous Issues of Vulnerability Weekly



—-

What is the CVE-2023-21715 Vulnerability?

CVE-2023-22515 is a critical zero-day vulnerability affecting publicly exposed instances of Confluence Data Center and Server from version 8 on.

A remote, unauthenticated attacker could exploit this privilege escalation to create unauthorized Confluence administrator accounts and access Confluence servers. Exploitation does not require user interaction and is easy to execute.
The confidentiality, integrity and availability of information are impacted to the highest degree.

Atlassian Confluence vulnerabilities refer to security flaws in the Confluence Data Center and Server that can be exploited to gain unauthorized access see vulnerabilities part of your Application Security program, manipulate data, or perform other malicious activities. These vulnerabilities are often critical and require immediate attention.

How Secure is Atlassian Confluence?

Atlassian Confluence is generally considered secure, and reliable for application security, with robust application security measures in place. However, like any software, it is not immune to defects, especially zero-day exploits that are often targeted by nation-state actors.

What is the Latest Vulnerability in Confluence?

This is a critical issue that allows the unauthorized creation of administrator accounts in publicly accessible Confluence instances.

How widespread is this vulnerability CVE-2023-21715?

Shodan currently displays more than 1000 systems across organizations mostly in the USA let’s explore more details on the critical issue

For this critical CVE

  • CVE- 10/9.8
  • CTI – 1.1 (low)
  • EPSS – Very High – 0.935270000
  • Exploit – Confirmed
  • Actors – Nation-state
  • Type: Privilege Escalation
Zero-Day Exploit
Nation-State
CVE-2023-22515
Vulnerable Versions
Security Patch
Data Center
Server

Currently, there are two streams of attackers on Graynoise divided into a group of 5 and 6 malicious actors but the growing

Credit Graynoise intelligence

What are the Vulnerable Versions of Confluence for CVE-2023-21715?

CVE-2023-22515 affects Confluence Data Center and Server versions 8.0.0 to 8.5.1. It’s crucial to upgrade to the latest versions to mitigate risks.

Affected Versions CVE-2023-21715

The Confluence Data Center and Server versions listed below are affected by this vulnerability. Customers using these versions should upgrade your instance as soon as possible.

Versions prior to 8.0.0 are not affected by this issue.

ProductAffected Versions
Confluence Data Center and Confluence Server8.0.08.0.18.0.28.0.38.0.48.1.08.1.18.1.38.1.48.2.08.2.18.2.28.2.38.3.08.3.18.3.28.4.08.4.18.4.28.5.08.5.1

Fixed Versions CVE-2023-21715

Atlassian recommends that you upgrade each of your affected installations to one of the listed fixed versions (or any later version) below.

ProductFixed Versions
Confluence Data Center and Confluence Server8.3.3 or later8.4.3 or later8.5.2 (Long Term Support release) or later

Mitigations

One of the mitigations below will prove effective.

  • Restrict external network access to the vulnerable instance
  • Bring the vulnerable instance offline
  • 1. Block access to the /setup/* endpoints on Confluence instances. This is possible at the network layer or by making the following changes to Confluence configuration files.On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml  and add the following block of code (just before the </web-app> tag at the end of the file):

<security-constraint>

      <web-resource-collection>

        <url-pattern>/setup/*</url-pattern>

                                    <http-method-omission>*</http-method-omission>

                        </web-resource-collection>

      <auth-constraint />

            </security-constraint>

2. Restart Confluence.

How can Phoenix security help with CVE-2023-22515

Nation-State
CVE-2023-22515
Vulnerable Versions
Phoenix Security

When it comes to identifying which of your systems are exposed to critical vulnerabilities like CVE-2023-22515, Phoenix Security offers a single query and pane of glass for all the risky assets.

Analyse the vulnerability in the phoenix security vulnerability screen and Infrastructure screen to identify which system has been compromised (note since the time of publishing the image the EPSS has changed)

Nation-State
CVE-2023-22515
Vulnerable Versions
Phoenix Security

Our advanced vulnerability and infrastructure screens are designed to quickly identify systems that are externally facing, making it easier for you to take immediate action. By analyzing the CVE-2023-22515 vulnerability in both the vulnerability and infrastructure screens, Phoenix Security provides a comprehensive view of your risk landscape. This enables you to prioritize patches and other security measures effectively, ensuring that your Atlassian Confluence instances remain secure against zero-day exploits and nation-state threats.

Previous Issues of Vulnerability Weekly



Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Are never-ending critical alerts leaving you scrambling? Explore how reachability analysis identifies vulnerabilities that truly matter, saving your teams from needless patch frenzies. This session, hosted by the OWASP NYC Chapter, uncovers the latest insights in ASPM, remediation techniques, and application security best practices. Attendees learn how to streamline vulnerability management through practical examples, advanced risk scoring, and live demonstrations of container-based architectures. Expect lively discussions, real-world success stories, and expert tips on targeting only the exploitable weaknesses—rather than chasing every single alert in your backlog.
Francesco Cipollone
The cybersecurity landscape is evolving rapidly, demanding a threat-centric, risk-based approach to vulnerability management. With the U.S. favoring voluntary guidelines and Europe enforcing stricter regulations, organizations must navigate compliance while focusing on real exploitability over CVE volume. This blog delves into ASPM, cloud security, and regulatory intelligence, exploring how businesses can move beyond the traditional patch-and-pray model to address root cause vulnerabilities before they become critical risks.
Francesco Cipollone
Enhance your vulnerability management with Application Security Posture Management (ASPM) and reachability analysis. Discover how ASPM helps prioritize exploitable vulnerabilities, reduce security noise, and improve risk management. Learn about advanced techniques like code and container reachability, contextual deduplication, and Phoenix Security’s cutting-edge solutions for smarter, more effective application security.
Francesco Cipollone
The 2024 CWE Top 25 is out, and it’s no casual stroll through the vulnerability garden—especially when ransomware operators are busy planting path traversal exploits, while bug bounty hunters dig up endless injection flaws. In this blog, we examine the biggest risers, the most surprising dips, and the divergence between real-world exploit data and official CWE rankings. We’ll also reveal how AI-driven ASPM (Application Security Posture Management) and Phoenix Security’s contextual risk-based approach unite to help you focus on your most pressing threats. After all, not all flaws are created equal—some are simply more mischievous than others.
Francesco Cipollone
The 2024 CWE Top 25 list highlights the most dangerous software weaknesses. This article explores the methodology behind the list and how AI is improving threat detection. Discover how Application Security Posture Management (ASPM) and unified vulnerability management can help organizations address these critical threats.
Francesco Cipollone
Phoenix Security kicks off 2025 with recognition from Gartner Digital Markets through GetApp, solidifying its position as a leader in Application Security Posture Management (ASPM). Recognised for best customer success and support in ASPM, Phoenix Security empowers organisations with comprehensive, contextual vulnerability management and actionable cybersecurity solutions. With a user-friendly interface, robust real-time monitoring, and seamless risk prioritisation, the platform reduces alert fatigue while delivering precise remediation. As a cloud security leader, Phoenix Security continues to innovate, partnering with enterprises like LastPass and ClearBank to tackle the modern cybersecurity landscape head-on.
Francesco Cipollone
Derek

Derek Fisher

Head of product security at a global fintech

Derek Fisher – Head of product security at a global fintech. Speaker, instructor, and author in application security.

Derek is an award winning author of a children’s book series in cybersecurity as well as the author of “The Application Security Handbook.” He is a university instructor at Temple University where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led teams, large and small, at organizations in the healthcare and financial industries. He has built and matured information security teams as well as implemented organizational information security strategies to reduce the organizations risk.

Derek got his start in the hardware engineering space where he learned about designing circuits and building assemblies for commercial and military applications. He later pursued a computer science degree in order to advance a career in software development. This is where Derek was introduced to cybersecurity and soon caught the bug. He found a mentor to help him grow in cybersecurity and then pursued a graduate degree in the subject.

Since then Derek has worked in the product security space as an architect and leader. He has led teams to deliver more secure software in organizations from multiple industries. His focus has been to raise the security awareness of the engineering organization while maintaining a practice of secure code development, delivery, and operations.

In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

Jeevan Singh

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

christophe

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris

Chris Romeo

Co-Founder
Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

jim

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

The IKIGAI concept
x  Powerful Protection for WordPress, from Shield Security
This Site Is Protected By
ShieldPRO