Detections
Analytics

CVE-2023-22527

critical

Description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

From the Tenable Blog

CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Exploited in the Wild
CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Exploited in the Wild

Published: 2024-01-23

In the wild exploitation has begun for a recently disclosed, critical severity flaw in Atlassian Confluence Data Center and Server

References

https://thehackernews.com/2024/09/progress-whatsup-gold-exploited-just.html

https://www.trendmicro.com/en_us/research/24/h/godzilla-fileless-backdoors.html?&web_view=true

https://thehackernews.com/2024/08/atlassian-confluence-vulnerability.html

https://www.trendmicro.com/en_us/research/24/h/cve-2023-22527-cryptomining.html

https://www.darkreading.com/application-security/stealth-bomber-atlassian-confluence-exploits-drop-web-shells-in-memory

https://thehackernews.com/2024/02/cisa-warning-akira-ransomware.html?&web_view=true

https://isc.sans.edu/diary/rss/30576

https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-atlassian-confluence-rce-flaw/

https://www.bleepingcomputer.com/news/security/atlassian-warns-of-critical-rce-flaw-in-older-confluence-versions/

https://community.tenable.com/s/feed/0D53a00009QsErGCAV

https://jira.atlassian.com/browse/CONFSERVER-93833

https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615

http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html

Details

Source: Mitre, NVD

Published: 2024-01-16

Updated: 2025-02-09

Named Vulnerability: Godzilla BackdoorNamed Vulnerability: Atlassian ConfluenceKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.94409

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest