CVE-2023-22522
published 2023-12-06CVE-2023-22522: This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence…
PriorityP267high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
12.84%
95.9th percentile
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | confluence_data_center | — | — |
| atlassian | confluence_data_center | — | — |
| atlassian | confluence_data_center | — | — |
| atlassian | confluence_data_center | — | — |
| atlassian | confluence_data_center | — | — |
| atlassian | confluence_data_center | >= 4.0 < 7.19.17 | 7.19.17 |
| atlassian | confluence_data_center | >= 8.0.0 < 8.4.5 | 8.4.5 |
| atlassian | confluence_data_center | >= 8.5.0 < 8.5.4 | 8.5.4 |
| atlassian | confluence_data_center | >= 8.6.0 < 8.6.2 | 8.6.2 |
| atlassian | confluence_server | — | — |
| atlassian | confluence_server | — | — |
| atlassian | confluence_server | — | — |
| atlassian | confluence_server | — | — |
| atlassian | confluence_server | >= 4.0 < 7.19.17 | 7.19.17 |
| atlassian | confluence_server | >= 8.0.0 < 8.4.5 | 8.4.5 |
| atlassian | confluence_server | >= 8.5.0 < 8.5.4 | 8.5.4 |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x"; flow:established,to_client; http.response_body; content:"|3c|li|20|class|3d 22|print|2d|only|22 3e|Printed|20|by|20|Atlassian|20|Confluence|20|"; fast_pattern; pcre:"/^[4-7]\./R"; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,confluence.atlassian.com/security/cve-2023-22522-injection-vulnerability-in-confluence-data-center-and-confluence-server-1319570362.html; reference:cve,2023-22522; classtype:web-application-activity; sid:2049624; rev:1; metadata:affected_product Atlassian_Confluence, attack_target Web_Server, created_at 2023_12_08, cve CVE_2023_22522, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_12_08; target:src_ip;)
snort
alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M2"; flow:established,to_client; http.response_body; content:"|3c|li|20|class|3d 22|print|2d|only|22 3e|Printed|20|by|20|Atlassian|20|Confluence|20|8|2e|"; fast_pattern; pcre:"/^(?:[0123]\.|4\.[01234]|5\.[0123]|6\.[01])\x3c/R"; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,confluence.atlassian.com/security/cve-2023-22522-injection-vulnerability-in-confluence-data-center-and-confluence-server-1319570362.html; reference:cve,2023-22522; classtype:web-application-activity; sid:2049626; rev:1; metadata:affected_product Atlassian_Confluence, attack_target Web_Server, created_at 2023_12_08, cve CVE_2023_22522, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_12_08; target:src_ip;)
snort
alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M1"; flow:established,to_client; http.response_body; content:"|3c|meta|20|name|3d 22|ajs|2d|version|2d|number|22 20|content|3d 22|8|2e|"; fast_pattern; pcre:"/^(?:[0123]|4\.[01234]|5\.[0123]|6\.[01])\x22/R"; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,confluence.atlassian.com/security/cve-2023-22522-injection-vulnerability-in-confluence-data-center-and-confluence-server-1319570362.html; reference:cve,2023-22522; classtype:web-application-activity; sid:2049625; rev:1; metadata:affected_product Atlassian_Confluence, attack_target Web_Server, created_at 2023_12_08, cve CVE_2023_22522, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_12_08; target:src_ip;)
- →Detect vulnerable Confluence 4.x–7.x servers by matching the version number meta tag in HTTP response bodies using the byte pattern for `<meta name="ajs-version-number" content="` followed by a version in the 4–7 range (Snort SID 2049623).
- →Detect vulnerable Confluence 8.x servers (M1 method) by matching the version number meta tag in HTTP response bodies for version 8.x with sub-version below the patched threshold (Snort SID 2049625).
- →Detect vulnerable Confluence 4.x–7.x servers (M2 method) by matching the print-only footer string in HTTP response bodies (Snort SID 2049624).
- →Detect vulnerable Confluence 8.x servers (M2 method) by matching the print-only footer string with version 8.x in HTTP response bodies, with sub-version below the patched threshold (Snort SID 2049626).
- →All four Snort rules are tuned to fire once per source IP per hour (threshold type limit, count 1, seconds 3600, track by_src), reducing alert fatigue while still flagging vulnerable server exposure.
- →The vulnerability affects all Confluence Data Center and Server versions after 4.0.0 up to 8.5.3; scope detection efforts to this version range. ↗
- ·No patch-time mitigation exists for CVE-2023-22522. If the patch cannot be applied immediately, Atlassian recommends taking affected instances offline rather than relying on any network-level workaround. ↗
- ·Atlassian Cloud (atlassian.net) instances are not affected; detection and patching efforts should focus exclusively on self-hosted Confluence Data Center and Server deployments. ↗
- ·The Snort rules detect *vulnerable server versions* in HTTP responses (passive fingerprinting), not active exploitation attempts. A match indicates an unpatched instance is exposed, not necessarily that an attack is in progress.
- ·SSL/TLS-decrypting sensors are required for these Snort rules to fire on HTTPS-served Confluence instances (deployment tag SSLDecrypt is set on all four rules).
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.0CRITICALCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x
suricata·2023-12-08·CVSS 8.8
CVE-2023-22522 [HIGH] ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x"; flow:established,to_client; http.response_body; content:"|3c|li|20|class|3d 22|print|2d|only|22 3e|Printed|20|by|20|Atlassian|20|Confluence|20|"; fast_pattern; pcre:"/^[4-7]\./R"; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,confluence.atlassian.com/security/cve-2023-22522-injection-vulnerability-in-confluence-data-center-and-confluence-server-1319570362.html; reference:cve,2023-22522; classtype:web-application-activity; sid:2049624; rev:1; metadata:affected_product Atlassian_Confluence, attack
Suricata
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M2
suricata·2023-12-08·CVSS 8.8
CVE-2023-22522 [HIGH] ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M2
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M2
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M2"; flow:established,to_client; http.response_body; content:"|3c|li|20|class|3d 22|print|2d|only|22 3e|Printed|20|by|20|Atlassian|20|Confluence|20|8|2e|"; fast_pattern; pcre:"/^(?:[0123]\.|4\.[01234]|5\.[0123]|6\.[01])\x3c/R"; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,confluence.atlassian.com/security/cve-2023-22522-injection-vulnerability-in-confluence-data-center-and-confluence-server-1319570362.html; reference:cve,2023-22522; classtype:web-application-activity; sid:2049626; rev:1; metadata:affected_p
Suricata
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M1
suricata·2023-12-08·CVSS 8.8
CVE-2023-22522 [HIGH] ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M1
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M1
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected Version 8.x M1"; flow:established,to_client; http.response_body; content:"|3c|meta|20|name|3d 22|ajs|2d|version|2d|number|22 20|content|3d 22|8|2e|"; fast_pattern; pcre:"/^(?:[0123]|4\.[01234]|5\.[0123]|6\.[01])\x22/R"; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,confluence.atlassian.com/security/cve-2023-22522-injection-vulnerability-in-confluence-data-center-and-confluence-server-1319570362.html; reference:cve,2023-22522; classtype:web-application-activity; sid:2049625; rev:1; metadata:affected_product Atlassian_Con
Suricata
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M1 Version 4.x-7.x
suricata·2023-12-08·CVSS 8.8
CVE-2023-22522 [HIGH] ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M1 Version 4.x-7.x
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M1 Version 4.x-7.x
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M1 Version 4.x-7.x"; flow:established,to_client; http.response_body; content:"|3c|meta|20|name|3d 22|ajs|2d|version|2d|number|22 20|content|3d 22|"; fast_pattern; pcre:"/^[4-7]\./R"; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html; reference:cve,2023-22522; classtype:web-application-activity; sid:2049623; rev:1; metadata:affected_product Atlassian_Confluence, attack_target Web_Serv
No public exploits indexed.
Wiz
Crying Out Cloud - January Newsletter | Wiz
blogs_wiz·2024-01-01·CVSS 8.8
CVE-2023-26360 [HIGH] Crying Out Cloud - January Newsletter | Wiz
This month we’ve seen several vulnerabilities and security incidents that have left users affected. We know you're busy too, so we've sifted through the noise to bring you the real game-changers.
Here are our top picks!
## 🐞 High Profile Vulnerabilities
Adobe ColdFusion RCE vulnerability exploited in-the-wild
CVE-2023-26360 is a critical vulnerability in Adobe ColdFusion that was published in March 2023. This vulnerability could allow an attacker to execute arbitrary code on the remote server in the context of the current user. On December 5, 2023, CISA announced that threat actors were actively exploiting this vulnerability in order to gain initial access to government-owned servers. Customers should update Adobe ColdFusion to the latest version.
According to Wiz data, less than 1% o
Checkpoint
11th December – Threat Intelligence Report
blogs_checkpoint·2023-12-11
CVE-2023-40088 11th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 11th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 11th December, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The American Greater Richmond Transit Company (GRTC), which provides services for millions of people, has been a victim of cyber-attack that impacted certain applications and parts of the GRTC network. The Play ransomware gang claimed responsibility for the attack.
Check Point Harmony Endpoint and Threat Emulation prov
Bleepingcomputer
Atlassian patches critical RCE flaws across multiple products
blogs_bleepingcomputer·2023-12-06·CVSS 8.3
[HIGH] Atlassian patches critical RCE flaws across multiple products
## Atlassian patches critical RCE flaws across multiple products
## Bill Toulas
Atlassian has published security advisories for four critical remote code execution (RCE) vulnerabilities impacting Confluence, Jira, and Bitbucket servers, along with a companion app for macOS.
All security issues addressed received a critical-severity score of at least 9.0 out of 10, based on Atlassian's internal assessment. However, the company advises companies to evaluate applicability according to their IT environment.
The company marked none of the security issues as being exploited in the wild. However, due to the popularity of Atlassian products and their extensive deployment in corporate environments, system administrators should prioritize applying the available updates.
The set of four RCE vuln
2023-12-06
Published