CVE-2023-22527 (GCVE-0-2023-22527)
Vulnerability from cvelistv5 – Published: 2024-01-16 05:00 – Updated: 2025-10-21 23:05Summary
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-14 05:00 UTC
CWE
- RCE (Remote Code Execution)
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Atlassian | Confluence Data Center |
Unaffected:
< 8.0.0
Affected: >= 8.0.0 Affected: >= 8.1.0 Affected: >= 8.2.0 Affected: >= 8.3.0 Affected: >= 8.4.0 Affected: >= 8.5.0 Affected: >= 8.5.1 Affected: >= 8.5.2 Affected: >= 8.5.3 Unaffected: >= 8.5.4 Unaffected: >= 8.6.0 Unaffected: >= 8.7.1 |
guessed | |
| Atlassian | Confluence Server |
Unaffected:
< 8.0.0
Affected: >= 8.0.0 Affected: >= 8.1.0 Affected: >= 8.2.0 Affected: >= 8.3.0 Affected: >= 8.4.0 Affected: >= 8.5.0 Affected: >= 8.5.1 Affected: >= 8.5.2 Affected: >= 8.5.3 Unaffected: >= 8.5.4 Unaffected: >= 8.6.0 |
guessed | |
| atlassian | confluence_data_center |
Affected:
8.0.0 , < 8.5.4
(custom)
cpe:2.3:a:atlassian:confluence_data_center:8.0.0:*:*:*:*:*:*:* |
||
| atlassian | confluence_server |
Affected:
8.0.0 , < 8.5.4
(custom)
cpe:2.3:a:atlassian:confluence_server:8.0.0:*:*:*:*:*:*:* |
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 3a67fc00-b513-4e4a-93dc-0ec25cf84eaa
Exploited: Yes
Timestamps
First Seen: 2024-01-24
Asserted: 2024-01-24
Scope
Notes: KEV entry: Atlassian Confluence Data Center and Server Template Injection Vulnerability | Affected: Atlassian / Confluence Data Center and Server | Description: Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2024-02-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html; https://nvd.nist.gov/vuln/detail/CVE-2023-22527
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-74 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | Confluence Data Center and Server |
| Due Date | 2024-02-14 |
| Date Added | 2024-01-24 |
| Vendorproject | Atlassian |
| Vulnerabilityname | Atlassian Confluence Data Center and Server Template Injection Vulnerability |
| Knownransomwarecampaignuse | Known |
References
Created: 2026-02-02 13:24 UTC
| Updated: 2026-02-06 07:53 UTC
Shadowserver
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: db0edb56-a1e5-48b9-8f4b-9a2fd5aa8ec1
Exploited: Yes
Characteristics
Severity:
100.0
Timestamps
First Seen: 2024-01-22
Asserted: 2024-01-22
Last Seen: 2026-09-07
Scope
Asset Exposure: ['internet-facing']
Notes: Affected: Atlassian / Confluence | Class: other-software | Severity: Critical (CVSS 10) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-07: 6
Evidence
Type: Honeypot
Signal: In The Wild Attempts
Confidence: 70%
Source: shadowserver
Details
| 1D | 6 |
|---|---|
| Iot | no |
| Feed | Shadowserver Foundation honeypot/exploited-vulnerabilities |
| Type | http-scan |
| Class | other-software |
| 7D Avg | 15 |
| Vendor | Atlassian |
| 30D Avg | 13 |
| 90D Avg | 12 |
| Product | Confluence |
| Cisa Kev | yes |
| Connections | 6 |
| Observation Date | 2026-09-07 |
| Vulnerability Class | CVSS |
| Vulnerability Score | 10 |
| Vulnerability Severity | Critical |
References
Created: 2026-07-01 05:53 UTC
| Updated: 2026-09-09 01:00 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 93fad5d0-2e3d-4681-a12f-64f5052eb2e5
Exploited: Yes
Timestamps
First Seen: 2024-01-24
Asserted: 2024-01-24
Scope
Notes: KEVIntel entry: A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an... | Affected: Atlassian / Confluence Data Center, Confluence Server | CVSS: 9.8 (CRITICAL) | EPSS: 0.99984 | Used in malware: yes | Not yet in CISA KEV: False
Evidence
Type: Public Report
Signal: Confirmed Compromise
Confidence: 70%
Source: kevintel
Details
| Feed | KEVIntel (kevintel.com) |
|---|---|
| Title | A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an... |
| Vendor | Atlassian |
| Product | Confluence Data Center, Confluence Server |
| Added Date | 2024-01-24T00:00:00.000Z |
| Cvss Score | 9.8 |
| Epss Score | 0.99984 |
| Cvss Severity | CRITICAL |
| Epss Percentile | 0.99982 |
| Used In Malware | yes |
| Ahead Of Cisa Kev | None |
| Not Yet In Cisa Kev | False |
References
Created: 2026-06-23 11:14 UTC
| Updated: 2026-06-23 11:14 UTC
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:atlassian:confluence_data_center:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "confluence_data_center",
"vendor": "atlassian",
"versions": [
{
"lessThan": "8.5.4",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:atlassian:confluence_server:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "confluence_server",
"vendor": "atlassian",
"versions": [
{
"lessThan": "8.5.4",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22527",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-14T05:00:58.661097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-01-24",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:05:28.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-24T00:00:00.000Z",
"value": "CVE-2023-22527 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-19T07:47:54.708Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
},
{
"tags": [
"x_transferred"
],
"url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
},
{
"url": "https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Confluence Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.1.0"
},
{
"status": "affected",
"version": "\u003e= 8.2.0"
},
{
"status": "affected",
"version": "\u003e= 8.3.0"
},
{
"status": "affected",
"version": "\u003e= 8.4.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.1"
},
{
"status": "affected",
"version": "\u003e= 8.5.2"
},
{
"status": "affected",
"version": "\u003e= 8.5.3"
},
{
"status": "unaffected",
"version": "\u003e= 8.5.4"
},
{
"status": "unaffected",
"version": "\u003e= 8.6.0"
},
{
"status": "unaffected",
"version": "\u003e= 8.7.1"
}
]
},
{
"product": "Confluence Server",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.1.0"
},
{
"status": "affected",
"version": "\u003e= 8.2.0"
},
{
"status": "affected",
"version": "\u003e= 8.3.0"
},
{
"status": "affected",
"version": "\u003e= 8.4.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.1"
},
{
"status": "affected",
"version": "\u003e= 8.5.2"
},
{
"status": "affected",
"version": "\u003e= 8.5.3"
},
{
"status": "unaffected",
"version": "\u003e= 8.5.4"
},
{
"status": "unaffected",
"version": "\u003e= 8.6.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Petrus Viet"
}
],
"descriptions": [
{
"lang": "en",
"value": "A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\u2019s January Security Bulletin."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "RCE (Remote Code Execution)",
"lang": "en",
"type": "RCE (Remote Code Execution)"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-26T17:06:21.681Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
},
{
"url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
},
{
"url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2023-22527",
"datePublished": "2024-01-16T05:00:00.692Z",
"dateReserved": "2023-01-01T00:01:22.333Z",
"dateUpdated": "2025-10-21T23:05:28.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2023-22527",
"cwes": [
"CWE-74"
],
"dateAdded": "2024-01-24",
"dueDate": "2024-02-14",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Known",
"notes": "https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html; https://nvd.nist.gov/vuln/detail/CVE-2023-22527",
"product": "Confluence Data Center and Server",
"requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.",
"vendorProject": "Atlassian",
"vulnerabilityName": "Atlassian Confluence Data Center and Server Template Injection Vulnerability"
},
"epss": {
"cve": "CVE-2023-22527",
"date": "2026-09-19",
"epss": "0.99984",
"percentile": "0.99982"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Confluence Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.1.0"
},
{
"status": "affected",
"version": "\u003e= 8.2.0"
},
{
"status": "affected",
"version": "\u003e= 8.3.0"
},
{
"status": "affected",
"version": "\u003e= 8.4.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.1"
},
{
"status": "affected",
"version": "\u003e= 8.5.2"
},
{
"status": "affected",
"version": "\u003e= 8.5.3"
},
{
"status": "unaffected",
"version": "\u003e= 8.5.4"
},
{
"status": "unaffected",
"version": "\u003e= 8.6.0"
},
{
"status": "unaffected",
"version": "\u003e= 8.7.1"
}
]
},
{
"product": "Confluence Server",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.1.0"
},
{
"status": "affected",
"version": "\u003e= 8.2.0"
},
{
"status": "affected",
"version": "\u003e= 8.3.0"
},
{
"status": "affected",
"version": "\u003e= 8.4.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.1"
},
{
"status": "affected",
"version": "\u003e= 8.5.2"
},
{
"status": "affected",
"version": "\u003e= 8.5.3"
},
{
"status": "unaffected",
"version": "\u003e= 8.5.4"
},
{
"status": "unaffected",
"version": "\u003e= 8.6.0"
}
]
}
],
"source": "security@atlassian.com"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:atlassian:confluence_data_center:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "confluence_data_center",
"vendor": "atlassian",
"versions": [
{
"lessThan": "8.5.4",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:atlassian:confluence_server:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "confluence_server",
"vendor": "atlassian",
"versions": [
{
"lessThan": "8.5.4",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"cisaActionDue": "2024-02-14",
"cisaExploitAdd": "2024-01-24",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Atlassian Confluence Data Center and Server Template Injection Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
"matchCriteriaId": "98686E6C-5D52-4EDB-A580-CE01009BADBA",
"versionEndExcluding": "8.5.4",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FED19C83-6D8B-45B1-AAC3-F4C6B12C0E4D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "82C2F4B6-A251-4D8B-8624-99079E50E331",
"versionEndExcluding": "8.5.4",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\u2019s January Security Bulletin."
},
{
"lang": "es",
"value": "Resumen de vulnerabilidad. Una vulnerabilidad de inyecci\u00f3n de plantilla en versiones anteriores de Confluence Data Center y Server permite que un atacante no autenticado logre RCE en una instancia afectada. Los clientes que utilicen una versi\u00f3n afectada deben tomar medidas inmediatas. Las versiones compatibles m\u00e1s recientes de Confluence Data Center y Server no se ven afectadas por esta vulnerabilidad, ya que finalmente se mitig\u00f3 durante las actualizaciones peri\u00f3dicas de la versi\u00f3n. Sin embargo, Atlassian recomienda que los clientes tengan cuidado de instalar la \u00faltima versi\u00f3n para proteger sus instancias de vulnerabilidades no cr\u00edticas descritas en el Bolet\u00edn de seguridad de enero de Atlassian. Consulte \u201cWhat You Need to Do\u201d para obtener instrucciones detalladas. {panel:bgColor=#deebff} Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a trav\u00e9s de un dominio atlassian.net, est\u00e1 alojado en Atlassian y no es vulnerable a este problema. {panel} Versiones afectadas ||Producto||Versiones afectadas|| |Centro de datos y servidor de Confluence| 8.0.x 8.1.x 8.2.x 8.3.x 8.4.x 8.5.0 8.5.1 8.5.2 8.5.3| Versiones fijas ||Producto||Versiones fijas|| |Centro de datos y servidor de Confluence|8.5.4 (LTS)| |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| Qu\u00e9 debe hacer inmediatamente parchear a una versi\u00f3n fija Atlassian recomienda parchear cada una de sus instalaciones afectadas a la \u00faltima versi\u00f3n. Las versiones fijas enumeradas ya no son las versiones m\u00e1s actualizadas y no protegen su instancia de otras vulnerabilidades no cr\u00edticas, como se describe en el Bolet\u00edn de seguridad de enero de Atlassian. ||Producto||Versiones fijas||\u00daltimas versiones|| |Centro de datos y servidor de Confluence| 8.5.4 (LTS)| 8.5.5 (LTS) |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| 8.6.3 o posterior (solo centro de datos) 8.7.2 o posterior (solo centro de datos) Para obtener detalles adicionales, consulte el aviso completo."
}
],
"id": "CVE-2023-22527",
"lastModified": "2026-06-17T05:35:38.480",
"metrics": {
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "security@atlassian.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-22527",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-14T05:00:58.661097Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-01-16T05:15:08.290",
"references": [
{
"source": "security@atlassian.com",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
},
{
"source": "security@atlassian.com",
"tags": [
"Vendor Advisory"
],
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
},
{
"source": "security@atlassian.com",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527"
}
],
"sourceIdentifier": "security@atlassian.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-74"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-74"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2026-03-27T11:47:04+00:00",
"cve": "CVE-2023-22527",
"id": "CVE-2023-22527",
"initial_release_date": "2023-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "CVE-2023-22527",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-22527.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-19T07:47:54.708Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
},
{
"tags": [
"x_transferred"
],
"url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
},
{
"url": "https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:atlassian:confluence_data_center:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "confluence_data_center",
"vendor": "atlassian",
"versions": [
{
"lessThan": "8.5.4",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:atlassian:confluence_server:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "confluence_server",
"vendor": "atlassian",
"versions": [
{
"lessThan": "8.5.4",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22527",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-14T05:00:58.661097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-01-24",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-01T20:12:32.863Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-24T00:00:00.000Z",
"value": "CVE-2023-22527 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Confluence Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.1.0"
},
{
"status": "affected",
"version": "\u003e= 8.2.0"
},
{
"status": "affected",
"version": "\u003e= 8.3.0"
},
{
"status": "affected",
"version": "\u003e= 8.4.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.1"
},
{
"status": "affected",
"version": "\u003e= 8.5.2"
},
{
"status": "affected",
"version": "\u003e= 8.5.3"
},
{
"status": "unaffected",
"version": "\u003e= 8.5.4"
},
{
"status": "unaffected",
"version": "\u003e= 8.6.0"
},
{
"status": "unaffected",
"version": "\u003e= 8.7.1"
}
]
},
{
"product": "Confluence Server",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.0.0"
},
{
"status": "affected",
"version": "\u003e= 8.1.0"
},
{
"status": "affected",
"version": "\u003e= 8.2.0"
},
{
"status": "affected",
"version": "\u003e= 8.3.0"
},
{
"status": "affected",
"version": "\u003e= 8.4.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.0"
},
{
"status": "affected",
"version": "\u003e= 8.5.1"
},
{
"status": "affected",
"version": "\u003e= 8.5.2"
},
{
"status": "affected",
"version": "\u003e= 8.5.3"
},
{
"status": "unaffected",
"version": "\u003e= 8.5.4"
},
{
"status": "unaffected",
"version": "\u003e= 8.6.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Petrus Viet"
}
],
"descriptions": [
{
"lang": "en",
"value": "A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\u2019s January Security Bulletin."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "RCE (Remote Code Execution)",
"lang": "en",
"type": "RCE (Remote Code Execution)"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-26T17:06:21.681Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
},
{
"url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
},
{
"url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2023-22527",
"datePublished": "2024-01-16T05:00:00.692Z",
"dateReserved": "2023-01-01T00:01:22.333Z",
"dateUpdated": "2025-10-21T23:05:28.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…