VULNERABILITY INTELLIGENCE

CVE-2023-22527

CVSS score9.8 CRITICAL

EPSS probability99.98%

CISA KEVKnown exploited vulnerability

Published2024-01-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Atlassian Confluence Data Center and Server Template Injection Vulnerability

Vendor / product: Atlassian / Confluence Data Center and Server

Description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Weakness classification

nvd@nist.gov: CWE-74
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-74

Primary references

security@atlassian.com — Exploit, Third Party Advisory, VDB Entry
security@atlassian.com — Vendor Advisory
security@atlassian.com — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource