CVE-2023-22527: critical vulnerability in Atlassian Confluence Data Center
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 10epss 100%
from disclosure to weaponsame day
Published on NVDJan 16
1st PoCJan 16
metasploitJan 16
CISA KEV+8d
Action required by CISAfederal deadline: 2024-02-14
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
In short
Older versions of Confluence Data Center and Server have a template injection flaw that lets attackers without login credentials run arbitrary code on the server. This is a critical issue requiring immediate patching.
Technical detail
A template injection vulnerability (CWE-74) in affected Confluence versions allows unauthenticated remote code execution through malicious template input. The vulnerability exists in older versions and has been mitigated in current supported releases; exploitation requires only network access to the affected instance.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
public PoCs found — 45
githubgithub.com/Boogipop/CVE-2023-22527-Godzilla-MEMSHELL★ 76githubgithub.com/M0untainShley/CVE-2023-22527-MEMSHELL★ 40githubgithub.com/Avento/CVE-2023-22527_Confluence_RCE★ 26githubgithub.com/Manh130902/CVE-2023-22527-POC★ 22githubgithub.com/VNCERT-CC/CVE-2023-22527-confluence★ 19githubgithub.com/Vozec/CVE-2023-22527★ 14githubgithub.com/RevoltSecurities/CVE-2023-22527★ 10githubgithub.com/Chocapikk/CVE-2023-22527★ 9githubgithub.com/vulncheck-oss/cve-2023-22527★ 6githubgithub.com/adminlove520/CVE-2023-22527★ 5githubgithub.com/thanhlam-attt/CVE-2023-22527★ 5githubgithub.com/Privia-Security/CVE-2023-22527★ 5githubgithub.com/BBD-YZZ/Confluence-RCE★ 5githubgithub.com/C1ph3rX13/CVE-2023-22527★ 4githubgithub.com/yoryio/CVE-2023-22527★ 4githubgithub.com/Niuwoo/CVE-2023-22527★ 2githubgithub.com/Drun1baby/CVE-2023-22527★ 2githubgithub.com/MaanVader/CVE-2023-22527-POC★ 1githubgithub.com/kh4sh3i/CVE-2023-22527★ 1githubgithub.com/mylo-2001/AtlassianPwn★ 1githubgithub.com/thompson005/CVE-2023-22527★ 0githubgithub.com/YongYe-Security/CVE-2023-22527★ 0vulncheckvulncheck.com/xdb/1d0355391a2funverifiedcve_referencepacketstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.htmlunverifiedvulncheckvulncheck.com/xdb/66eb62ffb562unverifiedvulncheckvulncheck.com/xdb/2054e543b959unverifiedvulncheckvulncheck.com/xdb/d6ff5abefc7eunverifiedvulncheckvulncheck.com/xdb/e16ed61a4005unverifiedvulncheckvulncheck.com/xdb/a3677d9bae7funverifiedvulncheckvulncheck.com/xdb/0d89d6d2a198unverifiedvulncheckvulncheck.com/xdb/95ac0d7b87c9unverifiedvulncheckvulncheck.com/xdb/b86f8af644dcunverifiedvulncheckvulncheck.com/xdb/30d9851d825eunverifiedvulncheckvulncheck.com/xdb/80a004854d64unverifiedvulncheckvulncheck.com/xdb/4530fd2e7aecunverifiedvulncheckvulncheck.com/xdb/b6e41e9efa89unverifiedvulncheckvulncheck.com/xdb/eddca0c3b6bfunverifiedvulncheckvulncheck.com/xdb/2868521052d3unverifiedvulncheckvulncheck.com/xdb/4875746a557funverifiedvulncheckvulncheck.com/xdb/7f5b35a2c887unverifiedvulncheckvulncheck.com/xdb/f3c6ccae29ceunverifiedvulncheckvulncheck.com/xdb/528b0751eaddunverifiedvulncheckvulncheck.com/xdb/6165cec850cdunverifiedvulncheckvulncheck.com/xdb/121a6655f702unverifiedvulncheckvulncheck.com/xdb/30047c15e01dunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Atlassian Confluence Data Center
In the same product, most dangerous first.
References
http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.htmlhttps://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615https://jira.atlassian.com/browse/CONFSERVER-93833https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527