PT-2023-7517 · Atlassian · Confluence

Sharada Moorthy · Published 2023-01-01 · Updated 2024-01-02 · CVE-2023-22522

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server versions 4.x.x through 8.5.3 Atlassian Confluence Data Center versions 4.x.x through 8.6.1

Description This issue allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page, achieving Remote Code Execution (RCE) on an affected instance. Atlassian Cloud sites are not affected by this issue. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Recommendations Immediately patch to a fixed version. For Confluence Data Center and Server, update to version 7.19.17 (LTS), 8.4.5, or 8.5.4 (LTS). For Confluence Data Center, update to version 8.6.2 or later, or 8.7.1 or later.

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-159

CWE-138

Related Identifiers

BDU:2023-08564

CVE-2023-22522

Affected Products

Confluence

References · 26

• https://jira.atlassian.com/browse/CONFSERVER-93502 · Vendor Advisory
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1319570362 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22522 · Security Note
• https://bdu.fstec.ru/vul/2023-08564 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22522 · Security Note
• https://twitter.com/CyberGovAU/status/1732644635950891092 · Twitter Post
• https://t.me/true_secator/5170 · Telegram Post
• https://vuldb.com/?id.247033 · Note
• https://twitter.com/jbhall56/status/1732748698860331170 · Twitter Post
• https://twitter.com/fletch_ai/status/1732627774383292422 · Twitter Post
• https://t.me/netlas/123 · Telegram Post
• https://twitter.com/ervik/status/1733046271424733228 · Twitter Post
• https://twitter.com/CVEnew/status/1732267367671984508 · Twitter Post
• https://twitter.com/qualys/status/1732865392014417967 · Twitter Post