Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in

CVE-2023-22527

🗓️ 16 Jan 2024 05:00:00Reported by atlassianType 
cve
 cve🔗 web.nvd.nist.gov📰️ 20 Media mentions👁 678 Views🌐 WEB

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE

Related
Detection
Affected
Refs
Paths
Social
ReporterTitlePublishedViews
Family
githubexploit
GithubExploit		CVE-Confluence
13 Aug 202611:38
–githubexploit
githubexploit
GithubExploit		Exploit for Injection in Atlassian Confluence_Data_Center
23 Jan 202417:07
–githubexploit
githubexploit
GithubExploit		Exploit for Injection in Atlassian Confluence_Data_Center
26 Feb 202402:34
–githubexploit
githubexploit
GithubExploit		BARE
13 Oct 202602:00
–githubexploit
githubexploit
GithubExploit		Exploit for Injection in Atlassian Confluence_Data_Center
23 Jan 202417:07
–githubexploit
githubexploit
GithubExploit		Exploit for Injection in Atlassian Confluence_Data_Center
23 Jan 202408:53
–githubexploit
githubexploit
GithubExploit		Exploit for Injection in Atlassian Confluence_Data_Center
22 Jan 202411:38
–githubexploit
githubexploit
GithubExploit		Exploit for Injection in Atlassian Confluence_Data_Center
23 Jan 202409:28
–githubexploit
githubexploit
GithubExploit		Exploit for Injection in Atlassian Confluence_Data_Center
25 Jan 202405:32
–githubexploit
githubexploit
GithubExploit		Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
10 Mar 202608:01
–githubexploit
Rows per page
NVD
Vulners
Vulnrichment
Node
OR
atlassianconfluence_data_centerRange8.0.0–8.5.4
atlassianconfluence_data_centerMatch8.7.0
Node
atlassianconfluence_serverRange8.0.0–8.5.4
[
  {
    "vendor": "Atlassian",
    "product": "Confluence Data Center",
    "versions": [
      {
        "version": "< 8.0.0",
        "status": "unaffected"
      },
      {
        "version": ">= 8.0.0",
        "status": "affected"
      },
      {
        "version": ">= 8.1.0",
        "status": "affected"
      },
      {
        "version": ">= 8.2.0",
        "status": "affected"
      },
      {
        "version": ">= 8.3.0",
        "status": "affected"
      },
      {
        "version": ">= 8.4.0",
        "status": "affected"
      },
      {
        "version": ">= 8.5.0",
        "status": "affected"
      },
      {
        "version": ">= 8.5.1",
        "status": "affected"
      },
      {
        "version": ">= 8.5.2",
        "status": "affected"
      },
      {
        "version": ">= 8.5.3",
        "status": "affected"
      },
      {
        "version": ">= 8.5.4",
        "status": "unaffected"
      },
      {
        "version": ">= 8.6.0",
        "status": "unaffected"
      },
      {
        "version": ">= 8.7.1",
        "status": "unaffected"
      }
    ]
  },
  {
    "vendor": "Atlassian",
    "product": "Confluence Server",
    "versions": [
      {
        "version": "< 8.0.0",
        "status": "unaffected"
      },
      {
        "version": ">= 8.0.0",
        "status": "affected"
      },
      {
        "version": ">= 8.1.0",
        "status": "affected"
      },
      {
        "version": ">= 8.2.0",
        "status": "affected"
      },
      {
        "version": ">= 8.3.0",
        "status": "affected"
      },
      {
        "version": ">= 8.4.0",
        "status": "affected"
      },
      {
        "version": ">= 8.5.0",
        "status": "affected"
      },
      {
        "version": ">= 8.5.1",
        "status": "affected"
      },
      {
        "version": ">= 8.5.2",
        "status": "affected"
      },
      {
        "version": ">= 8.5.3",
        "status": "affected"
      },
      {
        "version": ">= 8.5.4",
        "status": "unaffected"
      },
      {
        "version": ">= 8.6.0",
        "status": "unaffected"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
labelrequest body/template/aui/text-inline.vmTemplate injection via OGNL in Confluence template endpoint leading to RCECWE-74
xrequest body/template/aui/text-inline.vmTemplate injection via OGNL in Confluence template endpoint leading to RCECWE-74

N3mes1s

Wherearetheynow?Starring:ConfluenceCVE-2023-22527

TweetThreatNews

A critical vulnerability in Confluence (CVE-2023-22527) has enabled rapid LockBit ransomware deployment in under two hours. Swift action is vital to combat server-side exploitation. #Confluence #Ransomware #USA link: https://t.co/zDaa3brfav

f1tym1

ELPACO-Team Ransomware Attack Detection: Hackers Exploit Atlassian Confluence Vulnerability (CVE-2023-22527) to Gain RDP Access and Enable RCE https://t.co/X1YWqQvI4P In the rapidly evolving landscape of ransomware, threat actors are accelerating their tactics to gain access a…

Junior_Baines

(1/3) I spent some time looking at techniques to land a payload in memory using CVE-2023-22527 (Confluence). This writeup discusses three payloads, most importantly an in memory webshell, and has wider applicability outside of Confluence.

virusbtn

DFIR Labs look into a case in which the threat actor first gained entry by exploiting a known vulnerability (CVE-2023-22527) on an internet-facing Confluence server. The intrusion culminated in the deployment of ELPACO-team ransomware. https://t.co/ecyRTTmM0l

socradar

UPDATE: Cryptojacking Alert: CVE-2023-22527 is now actively exploited to launch crypto-jacking attacks on Atlassian’s Confluence Data Center and Server. Hackers are using malicious scripts and XMRig miners to infiltrate systems and disable security tools. https://t.co/VFAUJBPqaI #CyberSecurity #Cryptojacking #Vulnerability

ohhara_shiojiri

Cryptojacking Campaign Exploits Atlassian Confluence CVE-2023-22527 Vulnerability

TheHackersNews

A critical security flaw in Atlassian Confluence has been exploited for #cryptocurrency mining. This #vulnerability, CVE-2023-22527, allows unauthorized access, leading to potential severe financial and operational damage. Read: https://t.co/d71TBGW3nI #cybersecurity #hacking

the_yellow_fall

Researchers at Trend Micro have documented the exploitation of vulnerability CVE-2023-22527, which is being used to compromise #Atlassian servers by installing the #Godzilla backdoor

H4ckmanac

Critical Vulnerability Alert Atlassian Confluence vulnerability CVE-2023-22527 actively exploited for cryptocurrency mining https://t.co/Juv5iaEeA2 #vulnerability #atlassian #confluence #cryptocurrency #cyberthreatmonitoring #hackmanac

Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 05:35Current
8.3High risk
Vulners AI Score8.3
CVSS 3.19.8
CVSS 310
EPSS0.99984
SSVC
CWE-74In Wild
confluencedata centerservervulnerabilityrcepatchatlassiansecurity bulletin
678