Vulnerability-Lookup

CVE-2025-22166 (GCVE-0-2025-22166)

Vulnerability from cvelistv5 – Published: 2025-10-21 16:00 – Updated: 2025-10-21 16:21

Summary

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Atlassian (Internal) program.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-21 16:21 UTC

CWE

DoS (Denial of Service)
CWE-405 - Asymmetric Resource Consumption (Amplification)

Assigner

atlassian mitre root Scorecard

References

2 references

URL	Tags
https://confluence.atlassian.com/pages/viewpage.a…
https://jira.atlassian.com/browse/CONFSERVER-100907

Impacted products

1 product

Vendor	Product	Version
Atlassian	Confluence Data Center	Affected: 9.5.1 to 9.5.4 Affected: 9.4.0 to 9.4.1 Affected: 9.3.1 to 9.3.2 Affected: 9.2.0 to 9.2.6 Affected: 9.1.0 to 9.1.1 Affected: 9.0.1 to 9.0.3 Affected: 8.9.0 to 8.9.8 Affected: 8.8.0 to 8.8.1 Affected: 8.7.1 to 8.7.2 Affected: 8.6.1 to 8.6.2 Affected: 8.5.3 to 8.5.24 Affected: 7.19.16 to 7.19.30 Unaffected: 10.0.2 to 10.0.3 Unaffected: 9.2.7 to 9.2.9 Unaffected: 8.5.25 to 8.5.27 cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:9.4.1:::::::* cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:9.2.2:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.3:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.4:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.5:::::::* cpe:2.3:a:atlassian:confluence_data_center:9.2.6:::::::* cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:::::::: cpe:2.3:a:atlassian:confluence_data_center:8.5.13:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.5.22:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.5.23:::::::* cpe:2.3:a:atlassian:confluence_data_center:8.5.24:::::::* cpe:2.3:a:atlassian:confluence_data_center::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-21T16:21:21.142041Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-405",
                "description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T16:21:27.828Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 to 9.5.4"
            },
            {
              "status": "affected",
              "version": "9.4.0 to 9.4.1"
            },
            {
              "status": "affected",
              "version": "9.3.1 to 9.3.2"
            },
            {
              "status": "affected",
              "version": "9.2.0 to 9.2.6"
            },
            {
              "status": "affected",
              "version": "9.1.0 to 9.1.1"
            },
            {
              "status": "affected",
              "version": "9.0.1 to 9.0.3"
            },
            {
              "status": "affected",
              "version": "8.9.0 to 8.9.8"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1"
            },
            {
              "status": "affected",
              "version": "8.7.1 to 8.7.2"
            },
            {
              "status": "affected",
              "version": "8.6.1 to 8.6.2"
            },
            {
              "status": "affected",
              "version": "8.5.3 to 8.5.24"
            },
            {
              "status": "affected",
              "version": "7.19.16 to 7.19.30"
            },
            {
              "status": "unaffected",
              "version": "10.0.2 to 10.0.3"
            },
            {
              "status": "unaffected",
              "version": "9.2.7 to 9.2.9"
            },
            {
              "status": "unaffected",
              "version": "8.5.25 to 8.5.27"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.4.1",
                  "versionStartIncluding": "9.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.4.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.3.2",
                  "versionStartIncluding": "9.3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.2.6",
                  "versionStartIncluding": "9.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.4:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.5:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.6:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.1.1",
                  "versionStartIncluding": "9.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.0.3",
                  "versionStartIncluding": "9.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.9.8",
                  "versionStartIncluding": "8.9.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.8.1",
                  "versionStartIncluding": "8.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.7.2",
                  "versionStartIncluding": "8.7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.6.2",
                  "versionStartIncluding": "8.6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.5.24",
                  "versionStartIncluding": "8.5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.13:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.22:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.23:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.24:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "7.19.30",
                  "versionStartIncluding": "7.19.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.7:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.8:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.9:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.25:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.26:*:*:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.27:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7\r\n Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Atlassian (Internal) program."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "DoS (Denial of Service)",
              "lang": "en",
              "type": "DoS (Denial of Service)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-21T16:00:05.978Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034"
        },
        {
          "url": "https://jira.atlassian.com/browse/CONFSERVER-100907"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2025-22166",
    "datePublished": "2025-10-21T16:00:05.978Z",
    "dateReserved": "2025-01-01T00:01:27.176Z",
    "dateUpdated": "2025-10-21T16:21:27.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22166",
      "date": "2026-10-01",
      "epss": "0.00507",
      "percentile": "0.41073"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Confluence Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.5.1 to 9.5.4"
                  },
                  {
                    "status": "affected",
                    "version": "9.4.0 to 9.4.1"
                  },
                  {
                    "status": "affected",
                    "version": "9.3.1 to 9.3.2"
                  },
                  {
                    "status": "affected",
                    "version": "9.2.0 to 9.2.6"
                  },
                  {
                    "status": "affected",
                    "version": "9.1.0 to 9.1.1"
                  },
                  {
                    "status": "affected",
                    "version": "9.0.1 to 9.0.3"
                  },
                  {
                    "status": "affected",
                    "version": "8.9.0 to 8.9.8"
                  },
                  {
                    "status": "affected",
                    "version": "8.8.0 to 8.8.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.7.1 to 8.7.2"
                  },
                  {
                    "status": "affected",
                    "version": "8.6.1 to 8.6.2"
                  },
                  {
                    "status": "affected",
                    "version": "8.5.3 to 8.5.24"
                  },
                  {
                    "status": "affected",
                    "version": "7.19.16 to 7.19.30"
                  },
                  {
                    "status": "unaffected",
                    "version": "10.0.2 to 10.0.3"
                  },
                  {
                    "status": "unaffected",
                    "version": "9.2.7 to 9.2.9"
                  },
                  {
                    "status": "unaffected",
                    "version": "8.5.25 to 8.5.27"
                  }
                ]
              }
            ],
            "source": "security@atlassian.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D558D1C-94B1-4F03-B25D-5C9572ACD9D2",
                    "versionEndExcluding": "8.5.25",
                    "versionStartIncluding": "8.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CEEEF74E-9B32-4CA0-B892-C5559B44F031",
                    "versionEndExcluding": "9.2.7",
                    "versionStartIncluding": "9.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "46B5C105-6E80-4CE7-9928-8C0C6321E94E",
                    "versionEndExcluding": "10.0.2",
                    "versionStartIncluding": "10.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D8BA896B-97EF-4D11-82F8-BBCADE5DAE45",
                    "versionEndExcluding": "8.5.25",
                    "versionStartIncluding": "8.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9CFF1E61-C6D4-4699-AD54-C8C7F4D1282F",
                    "versionEndExcluding": "9.2.7",
                    "versionStartIncluding": "9.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "100D4CEB-7E91-4046-82D7-1BBF48EFB7E1",
                    "versionEndExcluding": "10.0.2",
                    "versionStartIncluding": "10.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7\r\n Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Atlassian (Internal) program."
          },
          {
            "lang": "es",
            "value": "Esta vulnerabilidad DoS (denegaci\u00f3n de servicio) de alta gravedad fue introducida en la versi\u00f3n 2.0 de Confluence Data Center.\n\nEsta vulnerabilidad DoS (denegaci\u00f3n de servicio), con una puntuaci\u00f3n CVSS de 8.3, permite a un atacante causar que un recurso no est\u00e9 disponible para sus usuarios previstos al interrumpir temporal o indefinidamente los servicios de un host conectado a una red.\n\nAtlassian recomienda que los clientes de Confluence Data Center actualicen a la \u00faltima versi\u00f3n; si no pueden hacerlo, actualicen su instancia a una de las versiones fijas compatibles especificadas:\n Confluence Data Center y Server 8.5: Actualizar a una versi\u00f3n mayor o igual a 8.5.25\n Confluence Data Center y Server 9.2: Actualizar a una versi\u00f3n mayor o igual a 9.2.7\n Confluence Data Center y Server 10.0: Actualizar a una versi\u00f3n mayor o igual a 10.0.2\n\nConsulte las notas de la versi\u00f3n ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). Puede descargar la \u00faltima versi\u00f3n de Confluence Data Center desde el centro de descargas ([https://www.atlassian.com/software/confluence/download-archives]).\n\nEsta vulnerabilidad fue reportada a trav\u00e9s de nuestro programa Atlassian (Interno)."
          }
        ],
        "id": "CVE-2025-22166",
        "lastModified": "2026-09-30T23:10:00.237",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security@atlassian.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-22166",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-21T16:21:21.142041Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-21T16:15:37.370",
        "references": [
          {
            "source": "security@atlassian.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-100907"
          }
        ],
        "sourceIdentifier": "security@atlassian.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-405"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-22166",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-21T16:21:21.142041Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-405",
                    "description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-21T16:20:52.235Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Confluence Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "9.5.1 to 9.5.4"
                },
                {
                  "status": "affected",
                  "version": "9.4.0 to 9.4.1"
                },
                {
                  "status": "affected",
                  "version": "9.3.1 to 9.3.2"
                },
                {
                  "status": "affected",
                  "version": "9.2.0 to 9.2.6"
                },
                {
                  "status": "affected",
                  "version": "9.1.0 to 9.1.1"
                },
                {
                  "status": "affected",
                  "version": "9.0.1 to 9.0.3"
                },
                {
                  "status": "affected",
                  "version": "8.9.0 to 8.9.8"
                },
                {
                  "status": "affected",
                  "version": "8.8.0 to 8.8.1"
                },
                {
                  "status": "affected",
                  "version": "8.7.1 to 8.7.2"
                },
                {
                  "status": "affected",
                  "version": "8.6.1 to 8.6.2"
                },
                {
                  "status": "affected",
                  "version": "8.5.3 to 8.5.24"
                },
                {
                  "status": "affected",
                  "version": "7.19.16 to 7.19.30"
                },
                {
                  "status": "unaffected",
                  "version": "10.0.2 to 10.0.3"
                },
                {
                  "status": "unaffected",
                  "version": "9.2.7 to 9.2.9"
                },
                {
                  "status": "unaffected",
                  "version": "8.5.25 to 8.5.27"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.4.1",
                      "versionStartIncluding": "9.4.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.4.1:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.3.2",
                      "versionStartIncluding": "9.3.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.2.6",
                      "versionStartIncluding": "9.2.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.2:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.3:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.4:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.5:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.6:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.1.1",
                      "versionStartIncluding": "9.1.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "9.0.3",
                      "versionStartIncluding": "9.0.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "8.9.8",
                      "versionStartIncluding": "8.9.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "8.8.1",
                      "versionStartIncluding": "8.8.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "8.7.2",
                      "versionStartIncluding": "8.7.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "8.6.2",
                      "versionStartIncluding": "8.6.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "8.5.24",
                      "versionStartIncluding": "8.5.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.13:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.22:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.23:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.24:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "7.19.30",
                      "versionStartIncluding": "7.19.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.7:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.8:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:9.2.9:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.25:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.26:*:*:*:*:*:*:*",
                      "vulnerable": false
                    },
                    {
                      "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.5.27:*:*:*:*:*:*:*",
                      "vulnerable": false
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7\r\n Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Atlassian (Internal) program."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
                "version": "4.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "DoS (Denial of Service)",
                  "lang": "en",
                  "type": "DoS (Denial of Service)"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-21T16:00:05.978Z",
            "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
            "shortName": "atlassian"
          },
          "references": [
            {
              "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034"
            },
            {
              "url": "https://jira.atlassian.com/browse/CONFSERVER-100907"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "assignerShortName": "atlassian",
        "cveId": "CVE-2025-22166",
        "datePublished": "2025-10-21T16:00:05.978Z",
        "dateReserved": "2025-01-01T00:01:27.176Z",
        "dateUpdated": "2025-10-21T16:21:27.828Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2025-AVI-0903

Vulnerability from certfr_avis - Published: 2025-10-22 - Updated: 2025-10-22

De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Atlassian	Jira	Jira Service Management Server versions antérieures à 5.12.28
Atlassian	Jira	Jira Software Server versions 11.1.x antérieures à 11.1.0
Atlassian	Jira	Jira Software Data Center versions 11.0.x antérieures à 11.0.1
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 5.12.28
Atlassian	Jira	Jira Service Management Server versions 11.0.x antérieures à 11.0.1
Atlassian	Confluence	Confluence Data Center versions 10.x antérieures à 10.0.2
Atlassian	Jira	Jira Service Management Data Center versions 11.1.x antérieures à 11.1.0
Atlassian	Jira	Jira Software Server versions 11.0.x antérieures à 11.0.1
Atlassian	Jira	Jira Software Server versions antérieures à 9.12.28
Atlassian	Jira	Jira Service Management Data Center versions 11.0.x antérieures à 11.0.1
Atlassian	Jira	Jira Service Management Server versions 10.3.x antérieures à 10.3.12
Atlassian	Confluence	Confluence Data Center versions 9.x antérieures à 9.2.7
Atlassian	Jira	Jira Service Management Server versions 11.1.x antérieures à 11.1.0
Atlassian	Jira	Jira Service Management Data Center versions 10.3.x antérieures à 10.3.12
Atlassian	Jira	Jira Software Data Center versions antérieures à 9.12.28
Atlassian	Jira	Jira Software Server versions 10.3.x antérieures à 10.3.12
Atlassian	Jira	Jira Software Data Center versions 11.1.x antérieures à 11.1.0
Atlassian	Confluence	Confluence Data Center versions antérieures à 8.5.25
Atlassian	Jira	Jira Software Data Center versions 10.3.x antérieures à 10.3.12

References

Title

Publication Time

EUVD-2026-255519

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 06:58

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T06:58:16.275968+00:00",
  "id": "EUVD-2026-255519"
}

FKIE_CVE-2025-22166

Vulnerability from fkie_nvd - Published: 2025-10-21 16:15 - Updated: 2026-09-30 23:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@atlassian.com	https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034	Vendor Advisory
	security@atlassian.com	https://jira.atlassian.com/browse/CONFSERVER-100907	Vendor Advisory

Impacted products

Vendor	Product	Version
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	confluence_server	*
atlassian	confluence_server	*
atlassian	confluence_server	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 to 9.5.4"
            },
            {
              "status": "affected",
              "version": "9.4.0 to 9.4.1"
            },
            {
              "status": "affected",
              "version": "9.3.1 to 9.3.2"
            },
            {
              "status": "affected",
              "version": "9.2.0 to 9.2.6"
            },
            {
              "status": "affected",
              "version": "9.1.0 to 9.1.1"
            },
            {
              "status": "affected",
              "version": "9.0.1 to 9.0.3"
            },
            {
              "status": "affected",
              "version": "8.9.0 to 8.9.8"
            },
            {
              "status": "affected",
              "version": "8.8.0 to 8.8.1"
            },
            {
              "status": "affected",
              "version": "8.7.1 to 8.7.2"
            },
            {
              "status": "affected",
              "version": "8.6.1 to 8.6.2"
            },
            {
              "status": "affected",
              "version": "8.5.3 to 8.5.24"
            },
            {
              "status": "affected",
              "version": "7.19.16 to 7.19.30"
            },
            {
              "status": "unaffected",
              "version": "10.0.2 to 10.0.3"
            },
            {
              "status": "unaffected",
              "version": "9.2.7 to 9.2.9"
            },
            {
              "status": "unaffected",
              "version": "8.5.25 to 8.5.27"
            }
          ]
        }
      ],
      "source": "security@atlassian.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D558D1C-94B1-4F03-B25D-5C9572ACD9D2",
              "versionEndExcluding": "8.5.25",
              "versionStartIncluding": "8.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CEEEF74E-9B32-4CA0-B892-C5559B44F031",
              "versionEndExcluding": "9.2.7",
              "versionStartIncluding": "9.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "46B5C105-6E80-4CE7-9928-8C0C6321E94E",
              "versionEndExcluding": "10.0.2",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8BA896B-97EF-4D11-82F8-BBCADE5DAE45",
              "versionEndExcluding": "8.5.25",
              "versionStartIncluding": "8.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CFF1E61-C6D4-4699-AD54-C8C7F4D1282F",
              "versionEndExcluding": "9.2.7",
              "versionStartIncluding": "9.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "100D4CEB-7E91-4046-82D7-1BBF48EFB7E1",
              "versionEndExcluding": "10.0.2",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7\r\n Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Atlassian (Internal) program."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad DoS (denegaci\u00f3n de servicio) de alta gravedad fue introducida en la versi\u00f3n 2.0 de Confluence Data Center.\n\nEsta vulnerabilidad DoS (denegaci\u00f3n de servicio), con una puntuaci\u00f3n CVSS de 8.3, permite a un atacante causar que un recurso no est\u00e9 disponible para sus usuarios previstos al interrumpir temporal o indefinidamente los servicios de un host conectado a una red.\n\nAtlassian recomienda que los clientes de Confluence Data Center actualicen a la \u00faltima versi\u00f3n; si no pueden hacerlo, actualicen su instancia a una de las versiones fijas compatibles especificadas:\n Confluence Data Center y Server 8.5: Actualizar a una versi\u00f3n mayor o igual a 8.5.25\n Confluence Data Center y Server 9.2: Actualizar a una versi\u00f3n mayor o igual a 9.2.7\n Confluence Data Center y Server 10.0: Actualizar a una versi\u00f3n mayor o igual a 10.0.2\n\nConsulte las notas de la versi\u00f3n ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). Puede descargar la \u00faltima versi\u00f3n de Confluence Data Center desde el centro de descargas ([https://www.atlassian.com/software/confluence/download-archives]).\n\nEsta vulnerabilidad fue reportada a trav\u00e9s de nuestro programa Atlassian (Interno)."
    }
  ],
  "id": "CVE-2025-22166",
  "lastModified": "2026-09-30T23:10:00.237",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@atlassian.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22166",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-21T16:21:21.142041Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-21T16:15:37.370",
  "references": [
    {
      "source": "security@atlassian.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/CONFSERVER-100907"
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-405"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-879M-MHMF-VG5R

Vulnerability from github – Published: 2025-10-21 18:30 – Updated: 2025-12-05 21:30

Details

This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Atlassian (Internal) program.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.3 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-22166"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-405"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-21T16:15:37Z",
    "severity": "HIGH"
  },
  "details": "This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\n\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\n\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7\n Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2\n\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\n\nThis vulnerability was reported via our Atlassian (Internal) program.",
  "id": "GHSA-879m-mhmf-vg5r",
  "modified": "2025-12-05T21:30:21Z",
  "published": "2025-10-21T18:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22166"
    },
    {
      "type": "WEB",
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-100907"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

WID-SEC-W-2025-2378

Vulnerability from csaf_certbund - Published: 2025-10-21 22:00 - Updated: 2025-11-18 23:00

Summary

Atlassian Confluence: Schwachstelle ermöglicht Denial of Service

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2025-22166.

CVE-2025-22166

Known affected: 7 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-22166 (GCVE-0-2025-22166)

CERTFR-2025-AVI-0903

Solutions

EUVD-2026-255519

FKIE_CVE-2025-22166

GHSA-879M-MHMF-VG5R

WID-SEC-W-2025-2378

Tags

Sightings

Nomenclature

Related by attack behaviour