Atlassian has issued a warning regarding potential exploitation of some instances of its Confluence data center and server software and has taken steps to patch the affected products.
According to the company’s advisory, a critical-rated vulnerability, identified as CVE-2023-22515, may have been exploited in certain customer environments. The exploitation could lead to the creation of unauthorized Confluence administrator accounts and unauthorized access to Confluence instances.
Notably, cloud instances accessed through an Atlassian domain remain unaffected by this vulnerability.
The bug specifically impacts Confluence data center and server versions ranging from 8.0.0 to 8.5.1; earlier versions are not affected. The patch has been applied to versions 8.3.3, 8.4.3, or 8.5.2 and later.
In response to this issue, Cloudflare also mentioned in a blog post that it was made aware of the bug by Atlassian before the advisory was released and has taken measures, such as applying web application firewall rules, to prevent exploitation for its customers.
For customers who are unable to apply the patch immediately, Atlassian’s advisory suggests they can restrict network access to the affected instances or block access to the /setup/* endpoints on Confluence instances as additional protective measures.