CVE-2023-22504
At a glance Severity MEDIUM 4.3 EPSS EPSS 0.75 % · percentile 55 (2026-10-27) State PUBLISHED Published 2023-05-25 Updated 2024-10-01 Assigner atlassian NVD status Modified Description Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature.
Scores Version Score Vector Scored by CVSS 3.0 MEDIUM 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N atlassian CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N NVD · nvd@nist.gov (Primary) CVSS 3.0 MEDIUM 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N NVD · security@atlassian.com (Secondary)
Weaknesses (CWE)
European references
Affected configurations (NVD CPE) cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* < 7.13.17cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.14.0 < 7.19.9cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* ≥ 7.20.0 < 8.2.2Affected products Product Versions Atlassian · Confluence Data Center unaffected < 1.1.2 ; affected >= 1.1.2 ; affected >= 7.14.0 ; affected >= 7.20.0 ; unaffected >= 7.13.7 ; unaffected >= 7.19.9 Atlassian · Confluence Server unaffected < 1.1.2 ; affected >= 1.1.2 ; affected >= 7.14.0 ; affected >= 7.20.0 ; unaffected >= 7.13.7 ; unaffected >= 7.19.9
References
Sources
