Strix
26.1K

CVE-2023-22522

HIGHCVSS 8.8/10EPSS 12.84%

Last modified

CVE-2023-22522 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. EPSS estimates a 12.84% chance of exploitation in the next 30 days.

Description

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
12.84%

95.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
AtlassianConfluence Data Center>= 4.0, < 7.19.17
AtlassianConfluence Data Center>= 8.0.0, < 8.4.5
AtlassianConfluence Data Center>= 8.5.0, < 8.5.4
AtlassianConfluence Data Center>= 8.6.0, < 8.6.2
AtlassianConfluence Data Center8.7.0
AtlassianConfluence Server>= 4.0, < 7.19.17
AtlassianConfluence Server>= 8.0.0, < 8.4.5
AtlassianConfluence Server>= 8.5.0, < 8.5.4

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-22522?
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
How severe is CVE-2023-22522?
CVE-2023-22522 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 12.84% probability of exploitation in the next 30 days.
How do I fix CVE-2023-22522?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-22522?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST