Atlassian Confluence Data Center
At a glance
- Source
- NVD
- EPSS
- EPSS 99.98 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- atlassian
- NVD status
- Analyzed
Description
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
Weaknesses (CWE)
- CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615
- https://jira.atlassian.com/browse/CONFSERVER-93833
- http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527
- https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | atlassian |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · security@atlassian.com (Secondary) |
European references
- ENISA EUVD · EUVD-2023-26667
- GCVE · GCVE-0-2023-22527
CERT-FR advisories
- CERTFR-2024-AVI-0040 — Multiples vulnérabilités dans Atlassian Confluence et Jira · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.5.4cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.5.4
Affected products
| Product | Versions |
|---|---|
| Atlassian · Confluence Data Center | unaffected < 8.0.0 ; affected >= 8.0.0 ; affected >= 8.1.0 ; affected >= 8.2.0 ; affected >= 8.3.0 ; affected >= 8.4.0 |
| Atlassian · Confluence Server | unaffected < 8.0.0 ; affected >= 8.0.0 ; affected >= 8.1.0 ; affected >= 8.2.0 ; affected >= 8.3.0 ; affected >= 8.4.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |