Riskcovery

CVE-2023-22522

State
Published
Severity
9.0 Critical
Published
Dec 6, 2023
Updated
Feb 25, 2026
Reserved
Jan 1, 2023

Read the record on cve.org

Description

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Scores

CVSSScoreVectorSource
3.09.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hatlassian

Weaknesses

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

ProductVersions
Confluence Data CenterAtlassian
  • < 4.0.0Not affected
  • >= 4.0.0Affected
  • >= 7.20.0Affected
  • >= 8.0.0Affected
  • >= 8.6.0Affected
  • >= 7.19.17Not affected
  • >= 8.4.5Not affected
  • >= 8.5.4Not affected
  • >= 8.6.2Not affected
  • >= 8.7.1Not affected
Confluence ServerAtlassian
  • < 4.0.0Not affected
  • >= 4.0.0Affected
  • >= 7.20.0Affected
  • >= 8.0.0Affected
  • >= 8.6.0Affected
  • >= 7.19.17Not affected
  • >= 8.4.5Not affected
  • >= 8.5.4Not affected
  • >= 8.6.2Not affected
  • >= 8.7.1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.