UpHeron
All vulnerabilities

Servers and applications

CVE-2023-22522

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the…

Severity
High 8.8
Published
6 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.19.17, 8.4.5, 8.5.4, 8.6.2
Sources
NVD

Affected software

SoftwareAffected versions
ConfluenceServers and applications · cpe:a:atlassian:confluence_data_center
  • From 4.0 before 7.19.17
  • From 8.0.0 before 8.4.5
  • From 8.5.0 before 8.5.4
  • From 8.6.0 before 8.6.2
  • Version 8.7.0
ConfluenceServers and applications · cpe:a:atlassian:confluence_server
  • From 4.0 before 7.19.17
  • From 8.0.0 before 8.4.5
  • From 8.5.0 before 8.5.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-22522
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-22522