gsd-2023-22527
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Summary of Vulnerability A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin. See “What You Need to Do” for detailed instructions. {panel:bgColor=#deebff} Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue. {panel} Affected Versions ||Product||Affected Versions|| |Confluence Data Center and Server| 8.0.x 8.1.x 8.2.x 8.3.x 8.4.x 8.5.0 8.5.1 8.5.2 8.5.3| Fixed Versions ||Product||Fixed Versions|| |Confluence Data Center and Server|8.5.4 (LTS)| |Confluence Data Center| 8.6.0 or later (Data Center Only) 8.7.1 or later (Data Center Only)| What You Need To Do Immediately patch to a fixed version Atlassian recommends that you patch each of your affected installations to the latest version. The listed Fixed Versions are no longer the most up-to-date versions and do not protect your instance from other non-critical vulnerabilities as outlined in Atlassian’s January Security Bulletin. ||Product||Fixed Versions||Latest Versions|| |Confluence Data Center and Server| 8.5.4 (LTS)| 8.5.5 (LTS) |Confluence Data Center| 8.6.0 or later (Data Center Only) 8.7.1 or later (Data Center Only)| 8.6.3 or later (Data Center Only) 8.7.2 or later (Data Center Only) For additional details, please see full advisory.
Aliases
Aliases
CVE-2023-22527


To clipboard 

{
  "GSD": {
    "alias": "CVE-2023-22527",
    "id": "GSD-2023-22527"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-22527"
      ],
      "details": "Summary of Vulnerability\r\nA template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\r\n\r\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\u2019s January Security Bulletin.\r\n\r\nSee \u201cWhat You Need to Do\u201d for detailed instructions.\r\n \r\n{panel:bgColor=#deebff}\r\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.\r\n{panel}\r\nAffected Versions\r\n||Product||Affected Versions||\r\n|Confluence Data Center and Server| 8.0.x\r\n 8.1.x\r\n 8.2.x\r\n 8.3.x\r\n 8.4.x\r\n 8.5.0\r\n 8.5.1\r\n 8.5.2\r\n 8.5.3|\r\nFixed Versions\r\n||Product||Fixed Versions||\r\n|Confluence Data Center and Server|8.5.4 (LTS)|\r\n|Confluence Data Center| 8.6.0 or later (Data Center Only)\r\n 8.7.1 or later (Data Center Only)|\r\nWhat You Need To Do\r\nImmediately patch to a fixed version\r\n\r\nAtlassian recommends that you patch each of your affected installations to the latest version. The listed Fixed Versions are no longer the most up-to-date versions and do not protect your instance from other non-critical vulnerabilities as outlined in Atlassian\u2019s January Security Bulletin.\r\n||Product||Fixed Versions||Latest Versions||\r\n|Confluence Data Center and Server|  8.5.4 (LTS)|  8.5.5 (LTS)\r\n|Confluence Data Center| 8.6.0 or later (Data Center Only)\r\n  8.7.1 or later (Data Center Only)|  8.6.3 or later (Data Center Only)\r\n 8.7.2 or later (Data Center Only)\r\n\r\nFor additional details, please see full advisory.",
      "id": "GSD-2023-22527",
      "modified": "2023-12-13T01:20:43.089202Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@atlassian.com",
        "ID": "CVE-2023-22527",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Confluence Data Center",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "versions": [
                              {
                                "status": "unaffected",
                                "version": "\u003c 8.0.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.0.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.1.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.2.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.3.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.4.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.5.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.5.1"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.5.2"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.5.3"
                              },
                              {
                                "status": "unaffected",
                                "version": "\u003e= 8.5.4"
                              },
                              {
                                "status": "unaffected",
                                "version": "\u003e= 8.6.0"
                              },
                              {
                                "status": "unaffected",
                                "version": "\u003e= 8.7.1"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Confluence Server",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "versions": [
                              {
                                "status": "unaffected",
                                "version": "\u003c 8.0.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.0.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.1.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.2.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.3.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.4.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.5.0"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.5.1"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.5.2"
                              },
                              {
                                "status": "affected",
                                "version": "\u003e= 8.5.3"
                              },
                              {
                                "status": "unaffected",
                                "version": "\u003e= 8.5.4"
                              },
                              {
                                "status": "unaffected",
                                "version": "\u003e= 8.6.0"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Atlassian"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Petrus Viet"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\u2019s January Security Bulletin."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "RCE (Remote Code Execution)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615",
            "refsource": "MISC",
            "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
          },
          {
            "name": "https://jira.atlassian.com/browse/CONFSERVER-93833",
            "refsource": "MISC",
            "url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
          },
          {
            "name": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "cisaActionDue": "2024-02-14",
        "cisaExploitAdd": "2024-01-24",
        "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
        "cisaVulnerabilityName": "Atlassian Confluence Data Center and Server Template Injection Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "98686E6C-5D52-4EDB-A580-CE01009BADBA",
                    "versionEndExcluding": "8.5.4",
                    "versionStartIncluding": "8.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E37A0F30-D0C8-46F3-9663-179B40FD8AAB",
                    "versionEndExcluding": "8.7.1",
                    "versionStartIncluding": "8.7.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "82C2F4B6-A251-4D8B-8624-99079E50E331",
                    "versionEndExcluding": "8.5.4",
                    "versionStartIncluding": "8.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian\u2019s January Security Bulletin."
          },
          {
            "lang": "es",
            "value": "Resumen de vulnerabilidad. Una vulnerabilidad de inyecci\u00f3n de plantilla en versiones anteriores de Confluence Data Center y Server permite que un atacante no autenticado logre RCE en una instancia afectada. Los clientes que utilicen una versi\u00f3n afectada deben tomar medidas inmediatas. Las versiones compatibles m\u00e1s recientes de Confluence Data Center y Server no se ven afectadas por esta vulnerabilidad, ya que finalmente se mitig\u00f3 durante las actualizaciones peri\u00f3dicas de la versi\u00f3n. Sin embargo, Atlassian recomienda que los clientes tengan cuidado de instalar la \u00faltima versi\u00f3n para proteger sus instancias de vulnerabilidades no cr\u00edticas descritas en el Bolet\u00edn de seguridad de enero de Atlassian. Consulte \u201cWhat You Need to Do\u201d para obtener instrucciones detalladas. {panel:bgColor=#deebff} Los sitios de Atlassian Cloud no se ven afectados por esta vulnerabilidad. Si se accede a su sitio de Confluence a trav\u00e9s de un dominio atlassian.net, est\u00e1 alojado en Atlassian y no es vulnerable a este problema. {panel} Versiones afectadas ||Producto||Versiones afectadas|| |Centro de datos y servidor de Confluence| 8.0.x 8.1.x 8.2.x 8.3.x 8.4.x 8.5.0 8.5.1 8.5.2 8.5.3| Versiones fijas ||Producto||Versiones fijas|| |Centro de datos y servidor de Confluence|8.5.4 (LTS)| |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| Qu\u00e9 debe hacer inmediatamente parchear a una versi\u00f3n fija Atlassian recomienda parchear cada una de sus instalaciones afectadas a la \u00faltima versi\u00f3n. Las versiones fijas enumeradas ya no son las versiones m\u00e1s actualizadas y no protegen su instancia de otras vulnerabilidades no cr\u00edticas, como se describe en el Bolet\u00edn de seguridad de enero de Atlassian. ||Producto||Versiones fijas||\u00daltimas versiones|| |Centro de datos y servidor de Confluence| 8.5.4 (LTS)| 8.5.5 (LTS) |Centro de datos de Confluence| 8.6.0 o posterior (solo centro de datos) 8.7.1 o posterior (solo centro de datos)| 8.6.3 o posterior (solo centro de datos) 8.7.2 o posterior (solo centro de datos) Para obtener detalles adicionales, consulte el aviso completo."
          }
        ],
        "id": "CVE-2023-22527",
        "lastModified": "2024-01-26T17:15:09.290",
        "metrics": {
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.0,
              "source": "security@atlassian.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-01-16T05:15:08.290",
        "references": [
          {
            "source": "security@atlassian.com",
            "url": "http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-93833"
          }
        ],
        "sourceIdentifier": "security@atlassian.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-74"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.