$ cve CVE-2023-22527 JSON

CVE-2023-22527 KEV

9.8

CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2024-02-14.

Description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.98% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-74
On CISA KEV	yes — remediate by 2024-02-14
Public exploit	none known
Published	2024-01-16
Last modified	2026-06-17

CISA KEV

Name	Atlassian Confluence Data Center and Server Template Injection Vulnerability
Added	2024-01-24
Due	2024-02-14
Vendor / product	Atlassian / Confluence Data Center and Server
Ransomware use	known

Affected (2)

Vendor	Product
atlassian	confluence data center
atlassian	confluence server

References

→ the Explorer · watch your stack · NVD