Actively exploited · Published Jan 16, 2024 · Assigned by atlassian

CVE-2023-22527

Critical 10.0 Exploited Ransomware

In plain English

A critical-severity injection in Confluence Data Center from Atlassian. Attackers are actively exploiting it in the wild (listed by CISA on January 24, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.0)10.0Critical

Exploit odds (30 days)100.0%top 0.0% of all CVEs

Exploited in the wildYesCISA KEV since Jan 24, 2024

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Feb 14, 2024.

Official description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Affected products (as reported)

Vendor	Product	Versions
Atlassian	Confluence Data Center	>= 8.0.0>= 8.1.0>= 8.2.0>= 8.3.0>= 8.4.0>= 8.5.0>= 8.5.1
Atlassian	Confluence Server	>= 8.0.0>= 8.1.0>= 8.2.0>= 8.3.0>= 8.4.0>= 8.5.0>= 8.5.1

Weakness: CWE-74 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

CISA guidance

Official description

Affected products (as reported)

References