Atlassian reveals critical Confluence RCE flaw, urges "immediate action" (CVE-2023-22527)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-22522 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page | 8.8 | 13% | ||
| CVE-2023-22527 | Unauthenticated OGNL Template Injection RCE in Atlassian Confluence Data Center/Server | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
From the original article
2 min read at helpnetsecurity.com
Atlassian has patched a critical vulnerability (CVE-2023-22527) in Confluence Data Center and Confluence Server that could lead to remote code execution. The good news is that the flaw was fixed in early December 2023 with the release of versions 8. 5.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.