Atlassian · Confluence Data Center and Server
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
Qué es
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
CISA: Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
Qué hacer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 14 de febrero de 2024
Más fallos explotados de Atlassian
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 7 nov 2023 | Improper Authorization | Confluence Data Center and Server | Crítica 10,0 | >99,9% |
| 5 oct 2023 | Broken Access Control | Confluence Data Center and Server | Crítica 10,0 | 99,2% |
| 15 oct 2026 | Files or Directories Accessible to External Parties | Multiple Products | Crítica 9,3 | 99,5% |
| 12 nov 2024 | Path Traversal | Jira Server and Data Center | Media 5,3 | >99,9% |
| 30 sept 2022 | Command Injection | Bitbucket Server and Data Center | Alto 8,8 | 99,1% |
| 29 jul 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Crítica 9,8 | 98% |
| 2 jun 2022 | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | Crítica 9,8 | >99,9% |
| 28 mar 2022 | Pre-Authorization Arbitrary File Read | Confluence Server | Media 5,3 | 99,9% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.