Detections
Analytics

Atlassian Confluence 8.0 < 8.5.4 (CONFSERVER-93833) (Direct Check)

critical Nessus Plugin ID 189636

Language:

Synopsis

The remote web server hosts a web application that is affected by remote code execution.

Description

The Atlassian Confluence Server running on the remote host has a confirmed vulnerability as referenced in the CONFSERVER-93833 advisory.

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian's January Security Bulletin.

Solution

Upgrade to Atlassian Confluence Server 8.6.0, 8.5.4, 8.7.1 or later.

See Also

https://jira.atlassian.com/browse/CONFSERVER-93833

http://www.nessus.org/u?679302f7

Plugin Details

Severity: Critical

ID: 189636

File Name: confluence_cve_2023_22527.nbin

Version: 1.19

Type: remote

Family: CGI abuses

Published: 1/26/2024

Updated: 11/22/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Critical

Score: 9.6

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-22527

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:atlassian:confluence

Required KB Items: installed_sw/confluence

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 1/16/2024

Vulnerability Publication Date: 1/4/2024

CISA Known Exploited Vulnerability Due Dates: 2/14/2024

Exploitable With

Core Impact

Metasploit (Atlassian Confluence SSTI Injection)

Reference Information

CVE: CVE-2023-22527