CVE-2023-22527

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
Atlassian	Confluence Data Center	>= 8.0.0; >= 8.1.0; >= 8.2.0; >= 8.3.0; >= 8.4.0; >= 8.5.0; >= 8.5.1; >= 8.5.2; >= 8.5.3
Atlassian	Confluence Server	>= 8.0.0; >= 8.1.0; >= 8.2.0; >= 8.3.0; >= 8.4.0; >= 8.5.0; >= 8.5.1; >= 8.5.2; >= 8.5.3
atlassian	confluence_data_center	>= 8.0.0, < 8.5.4
atlassian	confluence_server	>= 8.0.0, < 8.5.4

References

http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-93833Issue Tracking, Vendor Advisory
http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-93833Issue Tracking, Vendor Advisory
https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527US Government Resource

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 24, 2024
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-22536.5A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of rec CVE-2023-22544.8The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Sto CVE-2023-22555.3Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause CVE-2023-225517.5The FTP (aka "Implementation of a simple FTP client and server") project through 96c1a35 allows remote attackers to cause a denial of servic CVE-2023-22566.1The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Refl CVE-2023-22577.8Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an att CVE-2023-225727.8Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A lo CVE-2023-225735.5Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privileg CVE-2023-225748.1Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI mo CVE-2023-225758.8Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges CVE-2023-225767.8Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low pr CVE-2023-225777.5Within White Rabbit Switch it's possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP c