What’s Vulnerable › Vulnerabilities

CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-01-24
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-16 · updated 2026-06-17
• Weakness: CWE-74

Description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Summary

CVE-2023-22527 is a critical template injection flaw (CVSS 9.8) in older versions of Atlassian Confluence Data Center and Server that lets an unauthenticated attacker achieve remote code execution. It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit exists, and EPSS puts the 30-day exploitation probability at 100%. Affected instances should be upgraded immediately; the flaw is fixed in Confluence Data Center 8.5.4, and Atlassian notes that the most recent supported versions are not affected. If you cannot patch, apply the vendor's mitigations or discontinue use of the product.

CVE-2023-22527 ثغرة حقن قوالب (template injection) حرجة بدرجة CVSS 9.8 في الإصدارات الأقدم من Atlassian Confluence Data Center وServer، وتتيح لمهاجم غير مصادَق عليه تنفيذ تعليمات برمجية عن بُعد (RCE) على النسخة المتأثرة. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويتوفر استغلال عام، وتبلغ احتمالية الاستغلال خلال 30 يوماً وفق EPSS نسبة 100%. يجب ترقية النسخ المتأثرة فوراً؛ فقد تم إصلاح الثغرة في Confluence Data Center 8.5.4، وتشير Atlassian إلى أن أحدث الإصدارات المدعومة غير متأثرة. وإذا تعذّر الترقيع، فطبّق إجراءات التخفيف الموصى بها من المورّد أو أوقف استخدام المنتج.

Affected products

• Atlassian Confluence Data Center: from 8.0.0 before 8.5.4; 8.7.0 — fixed in 8.5.4
• Atlassian Confluence Data Center: from 8.0.0 before 8.5.4 — fixed in 8.5.4

How to fix

Upgrade to a fixed version: Atlassian Confluence Data Center 8.5.4; Atlassian Confluence Data Center 8.5.4. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615
• https://jira.atlassian.com/browse/CONFSERVER-93833
• http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615
• https://jira.atlassian.com/browse/CONFSERVER-93833
• https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527

Get alerted when CVE-2023-22527 or the next vulnerability affects your stack