Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-22527
CVE-2023-22527:
Confluence Server vulnerability analysis and mitigation
Overview
A template injection vulnerability (CVE-2023-22527) was discovered in older versions of Confluence Data Center and Server that allows an unauthenticated attacker to achieve Remote Code Execution (RCE) on affected instances. The vulnerability affects versions 8.0.x through 8.5.3, while version 7.19.x LTS is not affected. This critical vulnerability received a CVSS score of 9.8 (NIST) and 10.0 (Atlassian) (Atlassian Advisory, NVD).
Technical details
The vulnerability is classified as a template injection vulnerability (CWE-74) that allows for improper neutralization of special elements in output used by a downstream component. The vulnerability can be exploited without authentication and requires no user interaction, making it particularly dangerous. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability (NVD).
Impact
The vulnerability allows attackers to execute arbitrary code on affected systems without authentication. It has been actively exploited in cryptojacking attacks, where attackers deploy shell scripts and XMRig miners, target SSH endpoints, kill competing cryptomining processes, and maintain persistence through cron jobs (Trend Micro).
Mitigation and workarounds
Atlassian recommends immediate patching to the latest versions: 8.5.5 (LTS) for both Server and Data Center, or 8.7.2 for Data Center only. For customers unable to patch immediately, Atlassian recommends taking the system off the internet, backing up data to a secure location outside of the Confluence instance, and engaging local security teams to review for potential malicious activity (Atlassian Advisory).
Community reactions
The vulnerability has garnered significant attention in the security community due to its critical severity and active exploitation. CISA has added it to their Known Exploited Vulnerabilities Catalog with a remediation date of February 14, 2024, indicating its significance (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management