CVE-2023-22527 (GCVE-0-2023-22527)

Vulnerability from cvelistv5 – Published: 2024-01-16 05:00 – Updated: 2025-10-21 23:05
VLAI CISA KEV
Summary
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
Severity
10 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
  • RCE (Remote Code Execution)
Assigner
References
Impacted products
Vendor Product Version
Atlassian Confluence Data Center Unaffected: < 8.0.0
Affected: >= 8.0.0
Affected: >= 8.1.0
Affected: >= 8.2.0
Affected: >= 8.3.0
Affected: >= 8.4.0
Affected: >= 8.5.0
Affected: >= 8.5.1
Affected: >= 8.5.2
Affected: >= 8.5.3
Unaffected: >= 8.5.4
Unaffected: >= 8.6.0
Unaffected: >= 8.7.1
Create a notification for this product.
Atlassian Confluence Server Unaffected: < 8.0.0
Affected: >= 8.0.0
Affected: >= 8.1.0
Affected: >= 8.2.0
Affected: >= 8.3.0
Affected: >= 8.4.0
Affected: >= 8.5.0
Affected: >= 8.5.1
Affected: >= 8.5.2
Affected: >= 8.5.3
Unaffected: >= 8.5.4
Unaffected: >= 8.6.0
Create a notification for this product.
Credits
Petrus Viet
CISA KEV
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 62a35acf-9b98-4598-a3c9-2b87af1bf54f

Vulnerability ID: CVE-2023-22527

Status: Confirmed

Status Updated: 2024-01-24 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2024-01-24
Asserted: 2024-01-24
Scope
Notes: KEV entry: Atlassian Confluence Data Center and Server Template Injection Vulnerability | Affected: Atlassian / Confluence Data Center and Server | Description: Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2024-02-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html; https://nvd.nist.gov/vuln/detail/CVE-2023-22527
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-74
Feed CISA Known Exploited Vulnerabilities Catalog
Product Confluence Data Center and Server
Due Date 2024-02-14
Date Added 2024-01-24
Vendorproject Atlassian
Vulnerabilityname Atlassian Confluence Data Center and Server Template Injection Vulnerability
Knownransomwarecampaignuse Known
References
Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:atlassian:confluence_data_center:8.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "confluence_data_center",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "8.5.4",
                "status": "affected",
                "version": "8.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:atlassian:confluence_server:8.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "confluence_server",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "8.5.4",
                "status": "affected",
                "version": "8.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-22527",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-14T05:00:58.661097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-01-24",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-74",
                "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:28.527Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-01-24T00:00:00.000Z",
            "value": "CVE-2023-22527 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-19T07:47:54.708Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003c 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.3"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.5.4"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.6.0"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.7.1"
            }
          ]
        },
        {
          "product": "Confluence Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "\u003c 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.3.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.3"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.5.4"
            },
            {
              "status": "unaffected",
              "version": "\u003e= 8.6.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Petrus Viet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\u2019s January Security Bulletin."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "RCE (Remote Code Execution)",
              "lang": "en",
              "type": "RCE (Remote Code Execution)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-26T17:06:21.681Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
        },
        {
          "url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
        },
        {
          "url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2023-22527",
    "datePublished": "2024-01-16T05:00:00.692Z",
    "dateReserved": "2023-01-01T00:01:22.333Z",
    "dateUpdated": "2025-10-21T23:05:28.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2023-22527",
      "cwes": "[\"CWE-74\"]",
      "dateAdded": "2024-01-24",
      "dueDate": "2024-02-14",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-22527",
      "product": "Confluence Data Center and Server",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.",
      "vendorProject": "Atlassian",
      "vulnerabilityName": "Atlassian Confluence Data Center and Server Template Injection Vulnerability"
    },
    "epss": {
      "cve": "CVE-2023-22527",
      "date": "2026-05-25",
      "epss": "0.94354",
      "percentile": "0.99962"
    },
    "fkie_nvd": {
      "cisaActionDue": "2024-02-14",
      "cisaExploitAdd": "2024-01-24",
      "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "cisaVulnerabilityName": "Atlassian Confluence Data Center and Server Template Injection Vulnerability",
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndExcluding\": \"8.5.4\", \"matchCriteriaId\": \"98686E6C-5D52-4EDB-A580-CE01009BADBA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FED19C83-6D8B-45B1-AAC3-F4C6B12C0E4D\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndExcluding\": \"8.5.4\", \"matchCriteriaId\": \"82C2F4B6-A251-4D8B-8624-99079E50E331\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\\n\\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\\u2019s January Security Bulletin.\"}, {\"lang\": \"es\", \"value\": \"Resumen de vulnerabilidad. Una vulnerabilidad de inyecci\\u00f3n de plantilla en versiones anteriores de Confluence Data Center y Server permite que un atacante no autenticado logre RCE en una instancia afectada. Los clientes que utilicen una versi\\u00f3n afectada deben tomar medidas inmediatas. Las versiones compatibles m\\u00e1s recientes de Confluence Data Center y Server no se ven afectadas por esta vulnerabilidad, ya que finalmente se mitig\\u00f3 durante las actualizaciones peri\\u00f3dicas de la versi\\u00f3n. Sin embargo, Atlassian recomienda que los clientes tengan cuidado de instalar la \\u00faltima versi\\u00f3n para proteger sus instancias de vulnerabilidades no cr\\u00edticas descritas en el Bolet\\u00edn de seguridad de enero de Atlassian. Consulte \\u201cWhat You Need to Do\\u201d para obtener instrucciones detalladas. {panel:bgColor=#deebff} Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a trav\\u00e9s de un dominio atlassian.net, est\\u00e1 alojado en Atlassian y no es vulnerable a este problema. {panel} Versiones afectadas ||Producto||Versiones afectadas|| |Centro de datos y servidor de Confluence| 8.0.x 8.1.x 8.2.x 8.3.x 8.4.x 8.5.0 8.5.1 8.5.2 8.5.3| Versiones fijas ||Producto||Versiones fijas|| |Centro de datos y servidor de Confluence|8.5.4 (LTS)| |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| Qu\\u00e9 debe hacer inmediatamente parchear a una versi\\u00f3n fija Atlassian recomienda parchear cada una de sus instalaciones afectadas a la \\u00faltima versi\\u00f3n. Las versiones fijas enumeradas ya no son las versiones m\\u00e1s actualizadas y no protegen su instancia de otras vulnerabilidades no cr\\u00edticas, como se describe en el Bolet\\u00edn de seguridad de enero de Atlassian. ||Producto||Versiones fijas||\\u00daltimas versiones|| |Centro de datos y servidor de Confluence| 8.5.4 (LTS)| 8.5.5 (LTS) |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| 8.6.3 o posterior (solo centro de datos) 8.7.2 o posterior (solo centro de datos) Para obtener detalles adicionales, consulte el aviso completo.\"}]",
      "id": "CVE-2023-22527",
      "lastModified": "2024-11-21T07:44:59.040",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV30\": [{\"source\": \"security@atlassian.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 10.0, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 6.0}]}",
      "published": "2024-01-16T05:15:08.290",
      "references": "[{\"url\": \"http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html\", \"source\": \"security@atlassian.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615\", \"source\": \"security@atlassian.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-93833\", \"source\": \"security@atlassian.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-93833\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@atlassian.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-74\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-74\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-22527\",\"sourceIdentifier\":\"security@atlassian.com\",\"published\":\"2024-01-16T05:15:08.290\",\"lastModified\":\"2025-10-24T13:38:56.433\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\\n\\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\u2019s January Security Bulletin.\"},{\"lang\":\"es\",\"value\":\"Resumen de vulnerabilidad. Una vulnerabilidad de inyecci\u00f3n de plantilla en versiones anteriores de Confluence Data Center y Server permite que un atacante no autenticado logre RCE en una instancia afectada. Los clientes que utilicen una versi\u00f3n afectada deben tomar medidas inmediatas. Las versiones compatibles m\u00e1s recientes de Confluence Data Center y Server no se ven afectadas por esta vulnerabilidad, ya que finalmente se mitig\u00f3 durante las actualizaciones peri\u00f3dicas de la versi\u00f3n. Sin embargo, Atlassian recomienda que los clientes tengan cuidado de instalar la \u00faltima versi\u00f3n para proteger sus instancias de vulnerabilidades no cr\u00edticas descritas en el Bolet\u00edn de seguridad de enero de Atlassian. Consulte \u201cWhat You Need to Do\u201d para obtener instrucciones detalladas. {panel:bgColor=#deebff} Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a trav\u00e9s de un dominio atlassian.net, est\u00e1 alojado en Atlassian y no es vulnerable a este problema. {panel} Versiones afectadas ||Producto||Versiones afectadas|| |Centro de datos y servidor de Confluence| 8.0.x 8.1.x 8.2.x 8.3.x 8.4.x 8.5.0 8.5.1 8.5.2 8.5.3| Versiones fijas ||Producto||Versiones fijas|| |Centro de datos y servidor de Confluence|8.5.4 (LTS)| |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| Qu\u00e9 debe hacer inmediatamente parchear a una versi\u00f3n fija Atlassian recomienda parchear cada una de sus instalaciones afectadas a la \u00faltima versi\u00f3n. Las versiones fijas enumeradas ya no son las versiones m\u00e1s actualizadas y no protegen su instancia de otras vulnerabilidades no cr\u00edticas, como se describe en el Bolet\u00edn de seguridad de enero de Atlassian. ||Producto||Versiones fijas||\u00daltimas versiones|| |Centro de datos y servidor de Confluence| 8.5.4 (LTS)| 8.5.5 (LTS) |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| 8.6.3 o posterior (solo centro de datos) 8.7.2 o posterior (solo centro de datos) Para obtener detalles adicionales, consulte el aviso completo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"security@atlassian.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}]},\"cisaExploitAdd\":\"2024-01-24\",\"cisaActionDue\":\"2024-02-14\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Atlassian Confluence Data Center and Server Template Injection Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.5.4\",\"matchCriteriaId\":\"98686E6C-5D52-4EDB-A580-CE01009BADBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FED19C83-6D8B-45B1-AAC3-F4C6B12C0E4D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.5.4\",\"matchCriteriaId\":\"82C2F4B6-A251-4D8B-8624-99079E50E331\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html\",\"source\":\"security@atlassian.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615\",\"source\":\"security@atlassian.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CONFSERVER-93833\",\"source\":\"security@atlassian.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://jira.atlassian.com/browse/CONFSERVER-93833\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-93833\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-19T07:47:54.708Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-22527\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-14T05:00:58.661097Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2024-01-24\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:atlassian:confluence_data_center:8.0.0:*:*:*:*:*:*:*\"], \"vendor\": \"atlassian\", \"product\": \"confluence_data_center\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.0.0\", \"lessThan\": \"8.5.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:atlassian:confluence_server:8.0.0:*:*:*:*:*:*:*\"], \"vendor\": \"atlassian\", \"product\": \"confluence_server\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.0.0\", \"lessThan\": \"8.5.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-01-24T00:00:00.000Z\", \"value\": \"CVE-2023-22527 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-74\", \"description\": \"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-01T20:12:32.863Z\"}}], \"cna\": {\"credits\": [{\"lang\": \"en\", \"value\": \"Petrus Viet\"}], \"metrics\": [{\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"Atlassian\", \"product\": \"Confluence Data Center\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"\u003c 8.0.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.1.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.3.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.4.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.3\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.5.4\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.6.0\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.7.1\"}]}, {\"vendor\": \"Atlassian\", \"product\": \"Confluence Server\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"\u003c 8.0.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.1.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.2.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.3.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.4.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.5.3\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.5.4\"}, {\"status\": \"unaffected\", \"version\": \"\u003e= 8.6.0\"}]}], \"references\": [{\"url\": \"https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615\"}, {\"url\": \"https://jira.atlassian.com/browse/CONFSERVER-93833\"}, {\"url\": \"http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\\n\\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\\u2019s January Security Bulletin.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"RCE (Remote Code Execution)\", \"description\": \"RCE (Remote Code Execution)\"}]}], \"providerMetadata\": {\"orgId\": \"f08a6ab8-ed46-4c22-8884-d911ccfe3c66\", \"shortName\": \"atlassian\", \"dateUpdated\": \"2024-01-26T17:06:21.681Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-22527\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:05:28.527Z\", \"dateReserved\": \"2023-01-01T00:01:22.333Z\", \"assignerOrgId\": \"f08a6ab8-ed46-4c22-8884-d911ccfe3c66\", \"datePublished\": \"2024-01-16T05:00:00.692Z\", \"assignerShortName\": \"atlassian\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.