CVE-2023-22505
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
18/07/2023
Last modified:
31/07/2023
Description
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server.<br />
<br />
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction.<br />
<br />
Atlassian recommends that you upgrade your instance to latest version. If you&#39;re unable to upgrade to latest, upgrade to one of these fixed versions: 8.3.2, 8.4.0. See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html).|https://confluence.atlassian.com/doc/confluence-release-notes-327.html).] You can download the latest version of Confluence Data Center & Server from the download center ([https://www.atlassian.com/software/confluence/download-archives).|https://www.atlassian.com/software/confluence/download-archives).] <br />
<br />
This vulnerability was discovered by a private user and reported via our Bug Bounty program.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* | 8.0.0 (including) | 8.3.2 (excluding) |
| cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* | 8.0.0 (including) | 8.3.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



