Critical severity · published Jan 16, 2024
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
RansomwareIn wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 24, 2024
Federal remediation dueFeb 14, 2024
Ransomware campaign useKnown
Affected products
Which versions
CO
Confluence · Atlassian
>= 8.0.0; >= 8.1.0; >= 8.2.0; >= 8.3.0; >= 8.4.0; >= 8.5.0; +3 more · source: vendor, NVD, CISA
CD
Confluence Data Center and Server · Atlassian
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-22527
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-22527
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
confluence.atlassian.com
https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615
jira.atlassian.com
https://jira.atlassian.com/browse/CONFSERVER-93833
packetstormsecurity.com
http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
More from Confluence
9.8
CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
9.8
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
9.8
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
9.8
CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
9.8
CVE-2021-26084
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
