Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-22522
CVE-2023-22522:
Confluence Server vulnerability analysis and mitigation
Overview
A critical severity Remote Code Execution (RCE) vulnerability (CVE-2023-22522) was discovered in Confluence Data Center and Server. This Template Injection vulnerability, disclosed on December 5, 2023, affects all versions since 4.0.0, allowing an authenticated attacker, including those with anonymous access, to inject unsafe user input into a Confluence page to achieve RCE. Notably, Atlassian Cloud sites accessed via atlassian.net domains are not affected by this vulnerability (Atlassian Advisory).
Technical details
The vulnerability has been assigned a critical severity rating with a CVSS score of 9.0 (vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) according to Atlassian's internal assessment. The vulnerability specifically involves a Template Injection mechanism that can be exploited by authenticated users, including those with anonymous access, to achieve Remote Code Execution on affected instances (Atlassian Advisory, NVD).
Impact
If exploited, this vulnerability allows attackers to achieve Remote Code Execution on affected Confluence instances, potentially leading to complete system compromise. The vulnerability affects all versions of Confluence Data Center and Server from version 4.0.0 onwards, putting a wide range of installations at risk (Atlassian Advisory).
Mitigation and workarounds
Atlassian recommends immediate patching to fixed versions: 7.19.17 (LTS), 8.4.5, 8.5.4 (LTS) for Confluence Data Center and Server, or 8.6.2 or later, 8.7.1 or later for Data Center only. If immediate patching is not possible, organizations should back up their instance and remove it from the internet until patching is possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until patched (Atlassian Advisory, Atlassian FAQ).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management