Atlassian · Confluence Data Center and Server
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
Nedir
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
CISA: Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
Ne yapmalı
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ABD federal kurumları için son tarih: 14 Şubat 2024
Atlassian için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 7 Kas 2023 | Improper Authorization | Confluence Data Center and Server | Kritik 10,0 | >99,9% |
| 5 Eki 2023 | Broken Access Control | Confluence Data Center and Server | Kritik 10,0 | 99,2% |
| 15 Eki 2026 | Files or Directories Accessible to External Parties | Multiple Products | Kritik 9,3 | 99,5% |
| 12 Kas 2024 | Path Traversal | Jira Server and Data Center | Orta 5,3 | >99,9% |
| 30 Eyl 2022 | Command Injection | Bitbucket Server and Data Center | Yüksek 8,8 | 99,1% |
| 29 Tem 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Kritik 9,8 | 98% |
| 2 Haz 2022 | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | Kritik 9,8 | >99,9% |
| 28 Mar 2022 | Pre-Authorization Arbitrary File Read | Confluence Server | Orta 5,3 | 99,9% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.