Confluence Data Center/Server CVE-2023-22515 (broken access control lets outsiders create admin accounts, CVSS 10, CISA KEV, AA23-289A): which versions are fixed and how do I check an old instance for rogue admins?

What it is: CVE-2023-22515, disclosed by Atlassian in October 2023, lets an unauthenticated attacker re-trigger Confluence's setup process and create a new administrator account on an internet-facing Confluence Data Center or Server instance. It was exploited as a zero-day by a nation-state actor and then widely, CISA added it to KEV and published advisory AA23-289A. Old self-managed Confluence 8.x instances that were never upgraded are still found and abused. Am I affected: - Confluence Data Center and Server 8.0.0 through 8.5.1. Versions before 8.0.0 are not affected by this CVE (but have their own, such as CVE-2023-22518 and CVE-2023-22527, so upgrade them anyway). - Atlassian Cloud (atlassian.net) is not affected. - Check the version at Administration > General Configuration > System Information, or in the page footer. Fix: 1. Upgrade to a fixed release (8.3.3, 8.4.3, 8.5.2 or later); today, move to a current supported Long Term Support release, which also covers later critical bugs. 2. If you can't upgrade at once: take the instance off the internet or restrict it to VPN/trusted IPs, and block external access to /setup/* paths at the reverse proxy, as Atlassian advised as an interim step. 3. Check for compromise (Atlassian's and CISA's indicators): unexpected members of the confluence-administrators group, newly created accounts, unknown installed apps/plugins, and requests in access logs to /server-info.action and /setup/ paths. 4. If you find signs of compromise, follow CISA's advice: treat the attacker as a full admin, isolate the server, rebuild it from a clean state, restore data from a backup taken before the compromise, and rotate credentials (including any stored in Confluence and its database). Verify: System Information shows a fixed/current version, /setup/ paths are not reachable from outside, and the admin group contains only known accounts. Sources: https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a https://nvd.nist.gov/vuln/detail/CVE-2023-22515