CVE-2023-22527

Description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

References

https://www.imperva.com/blog/new-sysrv-botnet-variant-makes-use-of-google-subdomain-to-spread-xmrig-miner/?web_view=true

https://www.darkreading.com/application-security/stealth-bomber-atlassian-confluence-exploits-drop-web-shells-in-memory

https://thehackernews.com/2024/02/cisa-warning-akira-ransomware.html?&web_view=true

https://www.rapid7.com/blog/post/2024/02/15/rce-to-sliver-ir-tales-from-the-field/

https://systemweakness.com/unraveling-three-critical-vulnerabilities-in-atlassian-confluence-cve-2023-22515-cve-2023-22518-071f58539142?gi=847a847c6ef0&source=rss------vulnerability-5

https://medium.com/@elniak/unraveling-three-critical-vulnerabilities-in-atlassian-confluence-cve-2023-22515-cve-2023-22518-071f58539142?source=rss------vulnerability-5

https://medium.com/@elniak/unraveling-three-critical-vulnerabilities-in-atlassian-confluence-cve-2023-22515-cve-2023-22518-071f58539142?source=rss------bug_bounty-5

https://thecyberthrone.in/2024/02/03/thecyberthrone-cybersecurity-newsletter-top-5-articles-january-2024/

https://www.hivepro.com/threat-digest/attacks-vulnerabilities-and-actors-22-january-to-28-january-2024/

https://securityaffairs.com/158086/hacking/cisa-adds-atlassian-confluence-data-center-bug-to-its-known-exploited-vulnerabilities-catalog.html?web_view=true

https://securityaffairs.com/158086/hacking/cisa-adds-atlassian-confluence-data-center-bug-to-its-known-exploited-vulnerabilities-catalog.html

https://www.hivepro.com/threat-advisory/critical-rce-flaw-in-atlassian-confluence-sparks-active-exploitation/

https://www.theregister.com/2024/01/22/atlassian_confluence_server_rce/

https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-atlassian-confluence-rce-flaw/

https://isc.sans.edu/diary/rss/30576

https://www.rapid7.com/blog/post/2024/01/19/etr-critical-cves-in-outdated-versions-of-atlassian-confluence-and-vmware-vcenter-server/

https://community.tenable.com/s/feed/0D53a00009QsErGCAV

https://www.bleepingcomputer.com/news/security/atlassian-warns-of-critical-rce-flaw-in-older-confluence-versions/

https://jira.atlassian.com/browse/CONFSERVER-93833

https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615

http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3