CVE-2023-22527

CRITICAL

Published 2024-01-16T05:00:00.692Z

Actions:

CVSS Score

V3.0

10.0

/10

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2023.03.01

0.973

probability

of exploitation in the wild

There is a 97.3% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-01-25

Exploit Probability

Percentile: 0.999

Higher than 99.9% of all CVEs

Attack Vector Metrics

Attack Vector

Not Available

Attack Complexity

Not Available

Privileges Required

Not Available

User Interaction

Not Available

Scope

Not Available

Impact Metrics

Confidentiality

Not Available

Integrity

Not Available

Availability

Not Available

Description

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Available Exploits

No exploits available for this CVE.

Security researchers at The DFIR Report have uncovered a highly coordinated attack that leveraged a critical remote code The post From Confluence Vulnerability (CVE-2023-22527) to LockBit Encryption: A Rapid Attack Chain appeared first on Cybersecurity News.

SecurityOnline.info 2025-02-25 01:37