CVE-2023-22505

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
18/07/2023
Last modified:
31/07/2023

Description

This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center &amp; Server.<br /> <br /> This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction.<br /> <br /> Atlassian recommends that you upgrade your instance to latest version. If you&amp;#39;re unable to upgrade to latest, upgrade to one of these fixed versions: 8.3.2, 8.4.0. See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html).|https://confluence.atlassian.com/doc/confluence-release-notes-327.html).] You can download the latest version of Confluence Data Center &amp; Server from the download center ([https://www.atlassian.com/software/confluence/download-archives).|https://www.atlassian.com/software/confluence/download-archives).] <br /> <br /> This vulnerability was discovered by a private user and reported via our Bug Bounty program.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* 8.0.0 (including) 8.3.2 (excluding)
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* 8.0.0 (including) 8.3.2 (excluding)


References to Advisories, Solutions, and Tools