{"cve":"CVE-2023-22527","nvd":{"published":"2024-01-16T05:15:08.290","modified":"2026-06-17T05:35:38.480","status":"Analyzed","description":"A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-74"],"references":["http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html","https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615","https://jira.atlassian.com/browse/CONFSERVER-93833","http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html","https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615"],"products":["atlassian:confluence_data_center","atlassian:confluence_server"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2023-22527","score":0.99984,"percentile":0.99982,"date":"2026-10-31"},"kev":{"cve":"CVE-2023-22527","date_added":"2024-01-24","due_date":"2024-02-14","vendor":"Atlassian","product":"Confluence Data Center and Server","known_ransomware":true},"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}