-
Public Security Vulnerability
-
Resolution: Fixed
-
Highest
-
7.20.0, 8.0.0, 4.0.0, 8.6.0
-
None
-
Severity 1 - Critical
-
9
-
Critical
-
CVE-2023-22522
-
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
-
RCE (Remote Code Execution)
-
Confluence Data Center, Confluence Server
Summary of Vulnerability
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve RCE on an affected instance. Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See “What You Need to Do” for detailed instructions.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Affected Versions
| Product | Affected Versions |
|---|---|
| Confluence Data Center and Server |
|
| Confluence Data Center |
|
Fixed Versions
| Product | Fixed Versions |
|---|---|
| Confluence Data Center and Server |
|
| Confluence Data Center |
|
What You Need To Do
Immediately patch to a fixed version
Atlassian recommends that you patch each of your affected installations to the latest version or one of the listed fixed versions below.
| Product | Fixed Versions |
|---|---|
| Confluence Data Center and Server |
|
| Confluence Data Center |
|
For additional details, please see full advisory.
- is action for
-
PRODSEC-5414 Loading...
[CONFSERVER-93502] RCE in Confluence Data Center and Server - CVE-2023-22522
Any reason why the Published transition was executed again by prodsec-jac-bot yesterday?
| Status | Original: Published [ 12873 ] | New: Published [ 12873 ] |
| Remote Link | New: This issue links to "Page (Confluence)" [ 880203 ] |
| Remote Link | New: This issue links to "Page (Confluence)" [ 850249 ] |
| Labels | Original: advisory advisory-released dont-import fixed-versions-published security | New: advisory advisory-released dont-import fixed-versions-published hot-conf-fixed security |
Is it really too much to ask, to properly populate the "Affects Version/s:"-field?
Checking the security vulnerability API I was rather surprised that CVE-2023-22522 didn't show up. But as the data is missing here... Well, that explains a lot. (For the record: This it the current data set: Affects Version/s: 7.20.0, 8.0.0, 4.0.0, 8.6.0)
I would really appreciate if you could fix this. Would make things a lot easier. Thank you very much.
| Comment | [ Why showing Label "fixed-versions-not-yet-published"? ] |
seems like Atlassian wants their customers to move to Atlassian Cloud as each advisory says Cloud sites are not affected.
We have upgraded to 7.19.16 version to mitigate the previous vulnerability last Saturday. Why does Atlassian want their users to upgrade their version every weekend? Why can't the Atlassian provide some patches for all the LTS versions and sub-versions? I guess if I upgrade to the fixed version this Saturday, another vulnerability would be introduced by Monday, then the Atlassian will ask the users to upgrade to the fixed version and it would repeat. It seems like the infinity loop. It looks like the Atlassian encourage the users not to use their products.
Atlassian team, we need the patch for the LTS versions. We can't just keep on working only on the upgrade, testing.. upgrade, testing.. upgrade, testing.. infinitely.
Hello, Last weekend we have upgraded to 8.9.7 ( Data Center ) and fix version will be 8.5.4 LTS onwards, but still why it is showing in my confluence application that affected with security vulnerabilities.
Can any one confirm on this?