CVE-2023-22503

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team. The affected versions are before version 7.13.15, from version 7.14.0 before 7.19.7, and from version 7.20.0 before 8.2.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Atlassian	Confluence Data Center	>= 7.20.2
Atlassian	Confluence Server	>= 7.20.2
atlassian	confluence_data_center	< 7.13.15; >= 7.14.0, < 7.19.7; >= 7.20.0, < 8.2.0
atlassian	confluence_server	< 7.13.15; >= 7.14.0, < 7.19.7; >= 7.20.0, < 8.2.0

References

https://jira.atlassian.com/browse/CONFSERVER-82403Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-82403Issue Tracking, Vendor Advisory

Timeline

Published: May 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-225046.5Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to u CVE-2023-225058.8This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Cent CVE-2023-225068.8This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo CVE-2023-225088.8This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Cent CVE-2023-22517.5Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.CVE-2023-225127.5This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS S CVE-2023-225138.8This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (CVE-2023-225147.8This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windo CVE-2023-225159.8Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknow CVE-2023-225168.8This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamb CVE-2023-225189.8All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability CVE-2023-22522.7The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importin