References https://blog.qualys.com/vulnerabilities-threat-research/2023/11/15/atlassian-confluence-broken-access-control-vulnerability-cve-2023-22515 https://developer.cloud.tencent.com/article/2403439 https://developer.cloud.tencent.com/article/2403439 https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html https://confluence.atlassian.com/display/SECURITY/CVE-2023-22515+-+Broken+Access+Control+Vulnerability+in+Confluence+Data+Center+and+Server https://sechub.in/view/2761389 https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis https://support.atlassian.com/atlassian-knowledge-base/kb/faq-for-cve-2023-22515/ https://cve.circl.lu/cve/CVE-2023-22515 https://securitylabs.datadoghq.com/articles/confluence-vulnerability-cve-2023-22515-overview-and-remediation/
Related VulnerabilitiesPoCCVE-2026-27826: mcp-atlassian < 0.17.0 - Server-Side Request ForgeryMCP Atlassian 存在SSRF漏洞(CVE-2026-27826)PoCconfluence-xslt-macro-ssrf: Atlassian Confluence XSLT Macro - Server-Side Request ForgeryPoCCVE-2017-5983: JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)Atlassian Jira Software Data Center And Server 需授权 路径遍历漏洞CVE-2019-3396: Atlassian Confluence Path TraversalAtlassian Confluence /json/setup-restore.action 文件上传漏洞(CVE-2023-22518)PoCCVE-2015-8399: Atlassian Confluence <5.8.17 - Information DisclosurePoCCVE-2017-9506: Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request ForgeryPoCCVE-2018-20824: Atlassian Jira WallboardServlet <7.13.1 - Cross-Site ScriptingPoCCVE-2018-5230: Atlassian Jira Confluence - Cross-Site Scripting