---
id: "CVE-2023-22515"
kind: "vulnerability"
aliases: ["CVE-2023-22515"]
title: "Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Atlassian Confluence Data Center and Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["8.3.3"], "affected": ">= 8.0.0, < 8.3.3", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["8.4.3"], "affected": ">= 8.4.0, < 8.4.3", "ecosystem": "vendor"}, {"name": "atlassian confluence data center", "fixed": ["8.5.2"], "affected": ">= 8.5.0, < 8.5.2", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["8.3.3"], "affected": ">= 8.0.0, < 8.3.3", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["8.4.3"], "affected": ">= 8.4.0, < 8.4.3", "ecosystem": "vendor"}, {"name": "atlassian confluence server", "fixed": ["8.5.2"], "affected": ">= 8.5.0, < 8.5.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["atlassian", "aws", "confluence", "exploited", "lab-disclosure", "ransomware", "self-hosted", "vendor"]
not_affected_if: ["confluence-cloud"]
published_at: "2023-10-04T14:15:10+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T17:33:06+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22515", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22515", "first_seen_at": "2026-10-23T22:29:04+00:00"}, {"source": "lab", "url": "https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html", "first_seen_at": "2026-10-24T17:33:06+00:00"}]
---

# Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have…

Atlassian Confluence Data Center and Server has a broken access control flaw that lets an unauthenticated attacker create new Confluence administrator accounts. The attacker then gets full access to the wiki's content and settings.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Atlassian Confluence Data Center and Server affected ? fixed ?
- vendor:atlassian confluence data center affected >= 8.0.0, < 8.3.3 fixed 8.3.3
- vendor:atlassian confluence data center affected >= 8.4.0, < 8.4.3 fixed 8.4.3
- vendor:atlassian confluence data center affected >= 8.5.0, < 8.5.2 fixed 8.5.2
- vendor:atlassian confluence server affected >= 8.0.0, < 8.3.3 fixed 8.3.3
- vendor:atlassian confluence server affected >= 8.4.0, < 8.4.3 fixed 8.4.3
- vendor:atlassian confluence server affected >= 8.5.0, < 8.5.2 fixed 8.5.2

## How to check

Look for unexpected administrator accounts in Confluence user management and check the Confluence version against Atlassian's advisory.

## Fix

Apply the mitigation or patch from Atlassian's advisory for CVE-2023-22515, or take the instance offline if no mitigation is available.
Check all affected instances for compromise per vendor instructions and report positive findings to CISA.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22515
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-22515
- 2026-10-24T17:33:06+00:00 lab https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html — AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director

## Documents

- [advisory] AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html

## From the sources

AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director

Introducing a new console experience for AWS WAF

You can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console. 

# AWS Managed Rules changelog

This section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019.

###### Note

This changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF.

For the IP reputation rule groups, this changelog reports changes to the rules and rule group, and it reports significant changes to the sources of the IP address lists that the rules use. It does not report changes to the IP address lists themselves, due to the dynamic nature of those lists. If you have questions about the IP address lists, contact your account manager or open a case at 

AWS Support Center

. 

| Rule group and rules | Description | Date |
| --- | --- | --- |
| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. | 2026-10-22 |
| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.4 of this rule group. The new `PHP2Shell_BODY_Extended` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618. For more information, see NIST: National Vulnerability Database: CVE-2026-109618. This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group. | 2026-10-22 |
| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY` | Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619. For CVE-2026-109618, the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21 |
| AWS WAF Bot Control rule group | Released static version 7.0 of this rule group. Added token provenance labels at the targeted protection level. These labels flag a change in the category of IP address between the request that acquired an AWS WAF token and the request that presents it. Added device ID labels at the targeted protection level. These labels come from the device ID that the AWS WAF Android SDK collects. Added the cloud service provider label `awswaf:managed:aws:bot-control:signal:cloud_service_provider:fastly`. For more information, see Bot Control labels. | 2026-10-15 |
| SQL database managed rule group This release updates the following rules: `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16 |
| Core rule set (CRS) managed rule group This release updates the following rules: `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.23 of this rule group. Improved detection signatures for the cross site scripting rules. | 2026-08-28 |
| SQL database managed rule group This release updates the following rules: `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.4 of this rule group. This release updates all rules to improve SQL injection detection logic. | 2026-08-12 |
| AWS WAF Bot Control rule group | Released static version 6.1 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, AI, Content Fetcher, Scraping Framework, Search Engine, Security, SEO, and Social Media. | 2026-07-24 |
| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `GenericLFI_BODY` | Released static version 1.22 of this rule group. Improved detection signatures for the generic LFI rules. | 2026-07-20 |
| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.26 of this rule group. Added the `REMOVE_NULLS` text transformation to the listed rule. | 2026-07-15 |
| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_QUERYSTRING` | Released static version 2.5 of this rule group. Removed `WindowsShellCommands_QUERYARGUMENTS` and replaced it with `WindowsShellCommands_QUERYSTRING`. Updated WindowsShellCommands rules to improve detection logic. | 2026-06-01 |
| AWS WAF Bot Control rule group | Released static version 6.0 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, Content Fetcher, and Search Engine. Expanded Web Bot Auth support to commercial partition regional AWS WAF integrations. Changed the behavior of Web Bot Auth verified bots to be treated as standard verified bots for all categories, not only the AI category. This static version does not change the default version behavior. | 2026-05-22 |
| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.3 of this rule group. Added new rules `SQLiExtendedPatterns_HEADER` and `SQLiExtendedPatterns_URIPATH`. Added `REPLACE_COMMENTS` text transformations to all rules. Added `JS_DECODE` text transformations to `SQLi_COOKIE`, `SQLi_URIPATH`, and to all the new rules. Updated all the rules to improve detection logic. Version_2.3 is the successor to Version_1.3, not Version_2.0. These are separate lineages with different detection trade-offs. Customers relying on Version_2.0 detection behavior should pin that version explicitly. | 2026-04-29 |
| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_COOKIE` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` | Released static version 2.4 of this rule group. Removed `WindowsShellCommands_COOKIE` and replaced it with `WindowsShellCommands_HEADER` which matches on all headers. Added new rule `WindowsShellCommands_URIPATH`. Added JSON body inspection to the `WindowsShellCommands_BODY`. Added double `URL_DECODE_UNI` and `JS_DECODE` text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28 |
| Core rule set (CRS) managed rule group `RestrictedExtensions_QUERYARGUMENTS` `RestrictedExtensions_URIPATH` | Released static version 1.21 of this rule group. Improved detection signatures for these rules. | 2026-04-06 |
| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` `PHPHighRiskMethodsVariables_HEADER` `PHPHighRiskMethodsVariables_URIPATH` | Released static version 2.2 of this rule group. Improved detections and added `PHPHighRiskMethodsVariables_URIPATH` rule. | 2026-03-24 |
| AWS WAF Bot Control rule group New rules: `CategoryPagePreview` `CategoryWebhooks` | R

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_