Atlassian Confluence Data Center
En bref
- Source
- NVD
- EPSS
- EPSS 99.98 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- atlassian
- Statut NVD
- Analyzed
Description
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
Faiblesses (CWE)
- CWE-74 — Neutralisation incorrecte d'éléments spéciaux (injection)
Références
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615
- https://jira.atlassian.com/browse/CONFSERVER-93833
- http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527
- https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | atlassian |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · security@atlassian.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2023-26667
- GCVE · GCVE-0-2023-22527
Avis du CERT-FR
- CERTFR-2024-AVI-0040 — Multiples vulnérabilités dans Atlassian Confluence et Jira · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.5.4cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.5.4
Produits affectés
| Produit | Versions |
|---|---|
| Atlassian · Confluence Data Center | unaffected < 8.0.0 ; affected >= 8.0.0 ; affected >= 8.1.0 ; affected >= 8.2.0 ; affected >= 8.3.0 ; affected >= 8.4.0 |
| Atlassian · Confluence Server | unaffected < 8.0.0 ; affected >= 8.0.0 ; affected >= 8.1.0 ; affected >= 8.2.0 ; affected >= 8.3.0 ; affected >= 8.4.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |