internet-facing-service-vulnerabilitywidely-deployed-product-advisoryproof-of-concept-releaserapid-weaponization

Unauthenticated RCE in Atlassian Confluence Data Center and Server

Vulnerability Disclosure · 4 sources · Updated 2mo ago · First seen Jan 16, 2024

Atlassian released fixes for CVE-2023-22527, a critical template-injection vulnerability in Confluence Data Center and Confluence Server that enables an unauthenticated attacker to execute arbitrary code remotely. The flaw has a CVSS score of 10.0, affects Confluence 8.0.x through 8.4.x and 8.5.0 through 8.5.3, and public proof-of-concept exploit code is available; internet-exposed instances face the greatest risk.

Organizations should immediately upgrade affected deployments to Confluence 8.5.4, 8.6.0, or 8.7.1 as applicable, and apply Atlassian’s associated security mitigations. The Dutch NCSC assessed the issue as High/High for exploitation likelihood and impact, underscoring the need to identify exposed vulnerable servers, patch them urgently, and review systems for signs of compromise.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jan 16, 2024

Reported Jan 25, 20243y ago
Dutch NCSC raises CVE-2023-22527 assessment to High/High
The Dutch NCSC raised its assessment of CVE-2023-22527 to High/High, citing a high likelihood of exploitation and high potential impact. The Digital Trust Center urged organizations to promptly implement Atlassian's recommended mitigations.
Ernstige kwetsbaarheid in oudere versies Atlassian Confluence | NCSC
Reported Jan 25, 20243y ago
Public proof-of-concept code for CVE-2023-22527 is published
Public proof-of-concept code demonstrating exploitation of CVE-2023-22527 became available, increasing the risk to internet-exposed vulnerable Confluence instances.
Ernstige kwetsbaarheid in oudere versies Atlassian Confluence | NCSC
Jan 16, 20243y ago
Atlassian issues security fixes for CVE-2023-22527
Atlassian issued security updates for CVE-2023-22527, a CVSS 10.0 unauthenticated template-injection flaw that permits remote arbitrary code execution in vulnerable Confluence Data Center and Server deployments. Affected releases include Confluence 8.0.x through 8.4.x and 8.5.0 through 8.5.3; fixed versions include 8.5.4, 8.6.0, and 8.7.1.
Security Bulletin - January 16 2024 | Atlassian Support | Atlassian Documentation

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated Template Injection RCE in Atlassian Confluence (CVE-2023-22527)

Affected products

2 linked

Confluence Data CenterConfluence Server

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Atlassian ConfluenceNews · Jan 26, 2024

Security Bulletin - January 16 2024 | Atlassian Support | Atlassian DocumentationOpen source ↗

Ncsc Nl NewsNews · Jan 25, 2024

Ernstige kwetsbaarheid in oudere versies Atlassian Confluence | NCSCOpen source ↗

Csirt SkNews · Jan 23, 2024

Kritická zraniteľnosť v Confluence Data Center a Server | CSIRT.SKOpen source ↗

Atlassian ConfluenceNews · Jan 16, 2024

CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence ServerOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Unauthenticated RCE in Atlassian Confluence Data Center and Server

How this story unfolded

Dutch NCSC raises CVE-2023-22527 assessment to High/High

Public proof-of-concept code for CVE-2023-22527 is published

Atlassian issues security fixes for CVE-2023-22527

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical Atlassian Confluence RCE Hit by Mass Internet Exploitation

Atlassian Advisory Warns of Critical Flaws Across Confluence, Jira, Bitbucket and More

Critical Atlassian RCE Flaws Expose Confluence, Bitbucket, Jira, and Companion App

Unauthenticated RCE in Atlassian Confluence Data Center and Server

How this story unfolded

Dutch NCSC raises CVE-2023-22527 assessment to High/High

Public proof-of-concept code for CVE-2023-22527 is published

Atlassian issues security fixes for CVE-2023-22527

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical Atlassian Confluence RCE Hit by Mass Internet Exploitation

Atlassian Advisory Warns of Critical Flaws Across Confluence, Jira, Bitbucket and More

Critical Atlassian RCE Flaws Expose Confluence, Bitbucket, Jira, and Companion App