Template Injection Vulnerability in Atlassian Confluence Server and Data Center

CVE-2023-22522

Summary

A Template Injection vulnerability exists in Atlassian Confluence which allows an authenticated user, even with anonymous access, to inject harmful user input into Confluence pages. This can lead to Remote Code Execution (RCE), putting affected instances at risk. Notably, Confluence Data Center and Server versions are susceptible, while Atlassian Cloud sites are not impacted by this issue. Administrators should evaluate their environments and apply the necessary patches as per the provided advisory for enhanced security.

News Articles

SC Magazine

CVE-2023-22527CVE-2023-22522

Thousands of exploit attempts reported on critical Atlassian Confluence RCE

Security researchers say they recorded several thousands exploit attempts on Atlassian Confluence RCE originating from more than 600 unique IP addresses.

1 year ago

SC Magazine

CVE-2023-22527CVE-2023-22522

Atlassian Confluence vulnerability enables remote code execution

The critical bug, given a maximum CVSS score of 10 by Atlassian, requires an urgent update to the fixed version to avoid exploitation.

1 year ago

Security Boulevard

CVE-2023-22527CVE-2023-22522

Confluence Remote Code Execution Vulnerability (CVE-2023-22527) Alert

Overview On January 16, NSFOCUS CERT detected that Atlassian officially released a security announcement fixing the remote code execution vulnerability (CVE-2023-22522) in Confluence Data Center and Confluence Server. This vulnerability is caused by template injection. Unauthenticated attackers can ...

1 year ago

More News...

References