CVE-2023-22512

{"id": "CVE-2023-22512", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@atlassian.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-01-16T18:15:09.130", "references": [{"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1283691616", "tags": ["Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "https://jira.atlassian.com/browse/CONFSERVER-91258", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this vulnerability allows an unauthenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a vulnerable host (Confluence instance) connected to a network, which has no impact to confidentiality, no impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 7.19: Upgrade to a release greater than or equal to 7.19.14 Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.1 Confluence Data Center and Server 8.6 or above: No need to upgrade, you're already on a patched version See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html ). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives ]). This vulnerability was reported via our Bug Bounty program."}, {"lang": "es", "value": "Esta vulnerabilidad de denegaci\u00f3n de servicio (DoS) de alta gravedad se introdujo en la versi\u00f3n 5.6.0 de Confluence Data Center and Server. Con una puntuaci\u00f3n CVSS de 7,5, permite a un atacante no autenticado provocar la indisponibilidad de un recurso para sus usuarios previstos mediante la interrupci\u00f3n temporal o indefinida de los servicios de un host vulnerable (instancia de Confluence) conectado a una red. Esto no afecta a la confidencialidad ni a la integridad, tiene un alto impacto en la disponibilidad y no requiere la interacci\u00f3n del usuario. Atlassian recomienda que los clientes de Confluence Data Center y Server actualicen a la \u00faltima versi\u00f3n. Si no pueden hacerlo, actualicen su instancia a una de las versiones corregidas compatibles especificadas: Confluence Data Center y Server 7.19: actualice a una versi\u00f3n mayor o igual a la 7.19.14 Confluence Data Center y Server 8.5: actualice a una versi\u00f3n mayor o igual a la 8.5.1 Confluence Data Center y Server 8.6 o posterior: no es necesario actualizar, ya tienen una versi\u00f3n parcheada Consulte las notas de la versi\u00f3n (https://confluence.atlassian.com/doc/confluence-release-notes-327.html ). Puede descargar la \u00faltima versi\u00f3n de Confluence Data Center y Server desde el centro de descargas (https://www.atlassian.com/software/confluence/download-archives ]). Esta vulnerabilidad se inform\u00f3 a trav\u00e9s de nuestro programa Bug Bounty."}], "lastModified": "2025-04-30T13:34:35.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "902E46F9-334A-41FF-B018-5EF723F3F1A5", "versionEndExcluding": "7.19.14", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6864ADF8-9209-4E0A-989A-4BEA4ABC3601", "versionEndExcluding": "8.5.1", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14D4E84F-17C0-40DF-9234-063D03434DB5", "versionEndExcluding": "7.19.14", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2C6F3F1-6E32-4083-A8F6-149C85F31626", "versionEndExcluding": "8.5.1", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}