CVE-2023-22527
Unauthenticated RCE in Confluence Data Center and Server template injection
⚡ KEV — Known Exploited
CVSS 10.0 (Critical)
EPSS 0.9730 (1th pct)
Technical Description
Unauthenticated RCE in Confluence Data Center and Server template injection.
Why this matters to your organisation:
CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.3% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.3% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Potential Impact
A vulnerability in confluence_data_center rated Critical (CVSS 10.0). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalogue, indicating it has been actively exploited in the wild.
✅ Recommended Next Action
Review CVE-2023-22527 and confirm whether confluence_data_center is in use.
Confidence: Not Affected
The installed version is outside the affected range.
CVE Details
| Product | atlassian confluence_data_center |
| Version Range | <= 8.5.3 → ∞ |
| Installed | 8.5.1 |
| Match Type | Version Not Affected |
| CVSS | 10.0 |
| KEV | YES |
| EPSS | 0.973 |
| Source |
NVD · Jan. 16, 2024 View reference ↗ |
Score Breakdown
⚡ KEV+40
🌐 Exposure+20
⭐ Importance+15
📈 EPSS+14.6
🔢 CVSS+10.0
Total100