« Volver al listado

CVE-2023-22527

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Template injection en Confluence sin autenticación (AV:N, PR:N) permite RCE remoto. CVSS crítico (C:H, I:H, A:H) confirma ejecución de código y compromiso total del servidor.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Tecnologías afectadas (2)

Atlassian — Confluence Data CenterAtlassian — Confluence Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-22527",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-22527",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-14T05:00:58.661097Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@atlassian.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Confluence Data Center",
          "versions": [
            {
              "status": "unaffected",
              "version": "< 8.0.0"
            },
            {
              "status": "affected",
              "version": ">= 8.0.0"
            },
            {
              "status": "affected",
              "version": ">= 8.1.0"
            },
            {
              "status": "affected",
              "version": ">= 8.2.0"
            },
            {
              "status": "affected",
              "version": ">= 8.3.0"
            },
            {
              "status": "affected",
              "version": ">= 8.4.0"
            },
            {
              "status": "affected",
              "version": ">= 8.5.0"
            },
            {
              "status": "affected",
              "version": ">= 8.5.1"
            },
            {
              "status": "affected",
              "version": ">= 8.5.2"
            },
            {
              "status": "affected",
              "version": ">= 8.5.3"
            },
            {
              "status": "unaffected",
              "version": ">= 8.5.4"
            },
            {
              "status": "unaffected",
              "version": ">= 8.6.0"
            },
            {
              "status": "unaffected",
              "version": ">= 8.7.1"
            }
          ]
        },
        {
          "vendor": "Atlassian",
          "product": "Confluence Server",
          "versions": [
            {
              "status": "unaffected",
              "version": "< 8.0.0"
            },
            {
              "status": "affected",
              "version": ">= 8.0.0"
            },
            {
              "status": "affected",
              "version": ">= 8.1.0"
            },
            {
              "status": "affected",
              "version": ">= 8.2.0"
            },
            {
              "status": "affected",
              "version": ">= 8.3.0"
            },
            {
              "status": "affected",
              "version": ">= 8.4.0"
            },
            {
              "status": "affected",
              "version": ">= 8.5.0"
            },
            {
              "status": "affected",
              "version": ">= 8.5.1"
            },
            {
              "status": "affected",
              "version": ">= 8.5.2"
            },
            {
              "status": "affected",
              "version": ">= 8.5.3"
            },
            {
              "status": "unaffected",
              "version": ">= 8.5.4"
            },
            {
              "status": "unaffected",
              "version": ">= 8.6.0"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:atlassian:confluence_data_center:8.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "atlassian",
          "product": "confluence_data_center",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0",
              "lessThan": "8.5.4",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:atlassian:confluence_server:8.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "atlassian",
          "product": "confluence_server",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0",
              "lessThan": "8.5.4",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-01-16T05:15:08.290",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-93833",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.atlassian.com/browse/CONFSERVER-93833",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin."
    },
    {
      "lang": "es",
      "value": "Resumen de vulnerabilidad. Una vulnerabilidad de inyección de plantilla en versiones anteriores de Confluence Data Center y Server permite que un atacante no autenticado logre RCE en una instancia afectada. Los clientes que utilicen una versión afectada deben tomar medidas inmediatas. Las versiones compatibles más recientes de Confluence Data Center y Server no se ven afectadas por esta vulnerabilidad, ya que finalmente se mitigó durante las actualizaciones periódicas de la versión. Sin embargo, Atlassian recomienda que los clientes tengan cuidado de instalar la última versión para proteger sus instancias de vulnerabilidades no críticas descritas en el Boletín de seguridad de enero de Atlassian. Consulte “What You Need to Do” para obtener instrucciones detalladas. {panel:bgColor=#deebff} Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a través de un dominio atlassian.net, está alojado en Atlassian y no es vulnerable a este problema. {panel} Versiones afectadas ||Producto||Versiones afectadas|| |Centro de datos y servidor de Confluence| 8.0.x 8.1.x 8.2.x 8.3.x 8.4.x 8.5.0 8.5.1 8.5.2 8.5.3| Versiones fijas ||Producto||Versiones fijas|| |Centro de datos y servidor de Confluence|8.5.4 (LTS)| |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| Qué debe hacer inmediatamente parchear a una versión fija Atlassian recomienda parchear cada una de sus instalaciones afectadas a la última versión. Las versiones fijas enumeradas ya no son las versiones más actualizadas y no protegen su instancia de otras vulnerabilidades no críticas, como se describe en el Boletín de seguridad de enero de Atlassian. ||Producto||Versiones fijas||Últimas versiones|| |Centro de datos y servidor de Confluence| 8.5.4 (LTS)| 8.5.5 (LTS) |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| 8.6.3 o posterior (solo centro de datos) 8.7.2 o posterior (solo centro de datos) Para obtener detalles adicionales, consulte el aviso completo."
    }
  ],
  "lastModified": "2026-06-17T05:35:38.480",
  "cisaActionDue": "2024-02-14",
  "cisaExploitAdd": "2024-01-24",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98686E6C-5D52-4EDB-A580-CE01009BADBA",
              "versionEndExcluding": "8.5.4",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:8.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FED19C83-6D8B-45B1-AAC3-F4C6B12C0E4D"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82C2F4B6-A251-4D8B-8624-99079E50E331",
              "versionEndExcluding": "8.5.4",
              "versionStartIncluding": "8.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Atlassian Confluence Data Center and Server Template Injection Vulnerability"
}