{"id":"CVE-2023-22527","published":"2024-01-16T05:15:08Z","modified":"2026-06-17T05:35:38Z","title":"Atlassian Confluence Data Center and Server Template Injection Vulnerability","vendor":"Atlassian","product":"Confluence Data Center and Server","tier":"core","eol":null,"description":{"text":"A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.\n\nMost recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.","provenance":"source","from":"NVD"},"summary":{"text":"A template injection flaw in older versions of Atlassian Confluence Data Center and Server lets an attacker inject expressions that the server then processes, which is an improper neutralization of special elements in output. Because the attack vector is network-reachable with low complexity and needs no privileges or user interaction, an unauthenticated remote attacker can achieve remote code execution on an affected instance; recent supported versions are not affected.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99984,"percentile":0.99982,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-01-24","dueDate":"2024-02-14","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-22527","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-01-19","exploitedFirstSeen":"2024-01-19","ransomware":true,"evidence":[{"url":"https://www.rapid7.com/blog/post/2024/01/19/etr-critical-cves-in-outdated-versions-of-atlassian-confluence-and-vmware-vcenter-server/","date":"2024-01-19"},{"url":"https://twitter.com/TheDFIRReport/status/1749066611678466205","date":"2024-01-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2023-22527","date":"2024-01-22"},{"url":"https://isc.sans.edu/diary/rss/30576","date":"2024-01-22"},{"url":"https://twitter.com/Shadowserver/status/1749372138685915645","date":"2024-01-22"},{"url":"https://twitter.com/TheDFIRReport/status/1749424404063232099?s=20","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2023-22527","date":"2024-01-23"},{"url":"https://twitter.com/catc0n/status/1749912359127105813?s=20","date":"2024-01-23"},{"url":"https://www.tenable.com/blog/cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection-exploited-in-the","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2023-22527","date":"2024-01-24"}],"evidenceTotal":1023,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615","tags":["Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-93833","tags":["Issue Tracking","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615","tags":["Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-93833","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527","tags":["Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22527","tags":["US Government Resource"]}],"techniques":[{"id":"T1221","name":"Template Injection","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other Injection","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2023-22527 is a template injection vulnerability that allows an unauthenticated adversary to achieve remote code execution. Adversaries have been observed exploiting this vulnerability for cryptomining purposes.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other Injection","mappingType":"primary_impact","evidence":[],"comment":"CVE-2023-22527 is a template injection vulnerability that allows an unauthenticated adversary to achieve remote code execution. Adversaries have been observed exploiting this vulnerability for cryptomining purposes.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-26667","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26667","exploited":true,"exploitedSince":"2024-01-24","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":22,"skipped":1,"earliest":"2024-01-16","earliestUrl":"https://github.com/Avento/CVE-2023-22527_Confluence_RCE","repos":[{"name":"Boogipop/CVE-2023-22527-Godzilla-MEMSHELL","url":"https://github.com/Boogipop/CVE-2023-22527-Godzilla-MEMSHELL","stars":75,"created":"2024-02-11"},{"name":"M0untainShley/CVE-2023-22527-MEMSHELL","url":"https://github.com/M0untainShley/CVE-2023-22527-MEMSHELL","stars":40,"created":"2024-02-26"},{"name":"Avento/CVE-2023-22527_Confluence_RCE","url":"https://github.com/Avento/CVE-2023-22527_Confluence_RCE","stars":26,"created":"2024-01-16"},{"name":"Manh130902/CVE-2023-22527-POC","url":"https://github.com/Manh130902/CVE-2023-22527-POC","stars":22,"created":"2024-01-23"},{"name":"VNCERT-CC/CVE-2023-22527-confluence","url":"https://github.com/VNCERT-CC/CVE-2023-22527-confluence","stars":18,"created":"2024-01-23"}]},"metasploit":[{"name":"Atlassian Confluence SSTI Injection","module":"exploit/multi/http/atlassian_confluence_rce_cve_2023_22527","type":"exploit","disclosureDate":"2024-01-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22527.rb"}],"nuclei":[{"id":"CVE-2023-22527","name":"Atlassian Confluence - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-22527.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22527.yaml"}],"first":{"date":"2024-01-16","source":"PoC-in-GitHub","url":"https://github.com/Avento/CVE-2023-22527_Confluence_RCE"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html","https://www.vicarius.io/vsociety/posts/pwning-confluence-via-ognl-injection-for-fun-and-learning-cve-2023-22527"],"flow":[{"stage":"primary","techniques":["T1496"],"provenance":"source"},{"stage":"related","techniques":["T1221"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2024-01-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22527","provenance":"source"},{"date":"2024-01-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2024-01-16","url":"https://github.com/Avento/CVE-2023-22527_Confluence_RCE","provenance":"source"},{"date":"2024-01-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.rapid7.com/blog/post/2024/01/19/etr-critical-cves-in-outdated-versions-of-atlassian-confluence-and-vmware-vcenter-server/","provenance":"source"},{"date":"2024-01-24","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-01-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26667","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":8},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1016 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 22 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}