CVE-2023-22515 — Atlassian Confluence Access Control
What this checks: whether an Atlassian Confluence host runs a version affected by unauth broken access control -> admin account creation. Read-only: it fingerprints Atlassian Confluence and reads the version, no exploitation.
3. Detection — reads the Atlassian Confluence version from the version exposed at /login.action, compares to 8.3.3 / 8.4.3 / 8.5.2 LTS (per branch; anything before 8.0.0 is not affected). Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Atlassian Confluence URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Atlassian Confluence Server and Data Center and sorts each host by whether its version falls below the CVE-2023-22515 fixed floors. CVE-2023-22515 is broken access control that can let an attacker create an administrator account. This check never posts an admin-create request. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /login.action, fingerprints Confluence from page markers, reads ajs-version-number, and compares that number to the 8.x floors in the graph. Builds older than 8.0.0 are treated as not affected. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. An affected row is a version signal only.
Run it on a schedule when Confluence 8.x fleets lag on patch windows. A node that stayed on 8.5.1 after neighbours moved is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /login.action on each host and fingerprint Confluence from page markers such as ajs-version-number and the powered-by footer.
Parse the version from ajs-version-number and compare it to the CVE-2023-22515 floors in the graph (8.3.3, 8.4.3, 8.5.2), treating builds below 8.0.0 as not affected.
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Confluence was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /login.action only. No setup or admin-create request.
Sample output
The records below are illustrative and do not come from a real run. They show one Confluence 8.x host below a CVE-2023-22515 floor, one at or above its floor, and one host that is not the product.
Builds on the 8.x lines below the floors in the graph: 8.3.3, 8.4.3, and 8.5.2. Versions below 8.0.0 are not affected. The compare uses the version Confluence itself served on /login.action.
Does an affected row mean an admin account was created?
No. The check only GETs /login.action and reads ajs-version-number. It does not hit a setup endpoint and it does not create an administrator.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of the public login page. It does not change Confluence state.
Does the check need credentials?
No. It fingerprints the public login page the way an external scanner would.
What is CVE-2023-22515?
Broken access control in Atlassian Confluence Server and Data Center that can allow privilege escalation through unauthorized administrator creation. This workflow maps hosts to that CVE by version exposure only.