vendor:
Confluence
by:
Unknown & Emir Polat
8.1
CVSS
CRITICAL
Authentication Bypass via Broken Access Control
284
CWE
Product Name: Confluence
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE: CVE-2023-22515
CPE: a:atlassian:confluence
Platforms Tested:
2023
Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control
This exploit targets a vulnerability in Atlassian Confluence servers that allows an attacker to bypass authentication. By sending a specially crafted request, an attacker can create a new admin account without requiring authentication on the targeted Atlassian server.
Mitigation:
Update to the latest patched version of Atlassian Confluence to prevent exploitation of this vulnerability.
