In the wild exploitation has begun for a recently disclosed, critical severity flaw in Atlassian Confluence Data Center and Server

CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Exploited in the Wild

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

The Atlassian Confluence Server running on the remote host has a confirmed vulnerability as referenced in the CONFSERVER-93833 advisory.

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian's January Security Bulletin.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 8.x prior to 8.5.4. It is, therefore, affected by a remote code execution vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-93833 advisory.

  - RCE (Remote Code Execution) in Confluence Data Center and Server due to a template injection     vulnerability. An unauthenticated, remote attacker, can exploit this vulnerability to run arbitrary     code on the affected instance. (CVE-2023-22527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
189636	Atlassian Confluence 8.0 < 8.5.4 (CONFSERVER-93833) (Direct Check)	Nessus	CGI abuses	critical
114150	Atlassian Confluence 8.x < 8.5.4 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
188068	Atlassian Confluence < 8.5.4 RCE (CONFSERVER-93833)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2023-22527

critical

Tenable Plugins

critical

critical

critical