CVE-2023-22522
Estado: ModificadaAlta (8.8)—
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 13%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-74
- CWE-74
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-22522",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-22522",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2023-12-07T05:00:08.839200Z"
}
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "security@atlassian.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 9,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2.2
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@atlassian.com",
"affectedData": [
{
"vendor": "Atlassian",
"product": "Confluence Data Center",
"versions": [
{
"status": "unaffected",
"version": "< 4.0.0"
},
{
"status": "affected",
"version": ">= 4.0.0"
},
{
"status": "affected",
"version": ">= 7.20.0"
},
{
"status": "affected",
"version": ">= 8.0.0"
},
{
"status": "affected",
"version": ">= 8.6.0"
},
{
"status": "unaffected",
"version": ">= 7.19.17"
},
{
"status": "unaffected",
"version": ">= 8.4.5"
},
{
"status": "unaffected",
"version": ">= 8.5.4"
},
{
"status": "unaffected",
"version": ">= 8.6.2"
},
{
"status": "unaffected",
"version": ">= 8.7.1"
}
]
},
{
"vendor": "Atlassian",
"product": "Confluence Server",
"versions": [
{
"status": "unaffected",
"version": "< 4.0.0"
},
{
"status": "affected",
"version": ">= 4.0.0"
},
{
"status": "affected",
"version": ">= 7.20.0"
},
{
"status": "affected",
"version": ">= 8.0.0"
},
{
"status": "affected",
"version": ">= 8.6.0"
},
{
"status": "unaffected",
"version": ">= 7.19.17"
},
{
"status": "unaffected",
"version": ">= 8.4.5"
},
{
"status": "unaffected",
"version": ">= 8.5.4"
},
{
"status": "unaffected",
"version": ">= 8.6.2"
},
{
"status": "unaffected",
"version": ">= 8.7.1"
}
]
}
]
}
],
"published": "2023-12-06T05:15:09.587",
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1319570362",
"tags": [
"Vendor Advisory"
],
"source": "security@atlassian.com"
},
{
"url": "https://jira.atlassian.com/browse/CONFSERVER-93502",
"tags": [
"Vendor Advisory"
],
"source": "security@atlassian.com"
},
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1319570362",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://jira.atlassian.com/browse/CONFSERVER-93502",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-74"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-74"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details\n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue."
},
{
"lang": "es",
"value": "Esta vulnerabilidad de inyección de plantilla permite a un atacante autenticado, incluido uno con acceso anónimo, inyectar entradas de usuario no seguras en una página de Confluence. Con este enfoque, un atacante puede lograr la ejecución remota de código (RCE) en una instancia afectada. Las versiones de acceso público de Confluence Data Center and Server que se enumeran a continuación están en riesgo y requieren atención inmediata. Consulte el aviso para obtener detalles adicionales. Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a través de un dominio atlassian.net, está alojado en Atlassian y no es vulnerable a este problema."
}
],
"lastModified": "2026-06-17T05:35:37.800",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A015179-59B5-4D96-9052-09DB29D0916C",
"versionEndExcluding": "7.19.17",
"versionStartIncluding": "4.0"
},
{
"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AA7D282-A8E0-489F-84C1-C6E408A9B4ED",
"versionEndExcluding": "8.4.5",
"versionStartIncluding": "8.0.0"
},
{
"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "083AB6F4-E31A-42A8-ADFD-78EC9707C2E3",
"versionEndExcluding": "8.5.4",
"versionStartIncluding": "8.5.0"
},
{
"criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D48F8516-17B8-4389-937F-3F9F739F6D0F",
"versionEndExcluding": "8.6.2",
"versionStartIncluding": "8.6.0"
},
{
"criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FED19C83-6D8B-45B1-AAC3-F4C6B12C0E4D"
},
{
"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3807D8DA-9B6B-4BC9-BDAA-ADA323D01BF6",
"versionEndExcluding": "7.19.17",
"versionStartIncluding": "4.0"
},
{
"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DAC707F-D5C9-45F8-AB03-2978D4D918E8",
"versionEndExcluding": "8.4.5",
"versionStartIncluding": "8.0.0"
},
{
"criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1272EBF-A45E-42A7-A71B-401DF806E38D",
"versionEndExcluding": "8.5.4",
"versionStartIncluding": "8.5.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@atlassian.com"
}