CVE-2023-22527

Confirmed PUBLISHED

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an...

Atlassian · Confluence Data Center, Confluence Server

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

ransomware nuclei_scanner metasploit cisa malware

CVE Published: Jan 16, 2024
Exploitation Reported: Jan 24, 2024
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

27 version rows · page 1 of 2

Vendor	Product	Version	Status
atlassian	confluence_data_center	8.0.0 to < 8.5.4	Affected
atlassian	confluence_server	8.0.0 to < 8.5.4	Affected
Atlassian	Confluence Data Center	< 8.0.0	Unaffected
Atlassian	Confluence Data Center	>= 8.0.0	Affected
Atlassian	Confluence Data Center	>= 8.1.0	Affected
Atlassian	Confluence Data Center	>= 8.2.0	Affected
Atlassian	Confluence Data Center	>= 8.3.0	Affected
Atlassian	Confluence Data Center	>= 8.4.0	Affected
Atlassian	Confluence Data Center	>= 8.5.0	Affected
Atlassian	Confluence Data Center	>= 8.5.1	Affected
Atlassian	Confluence Data Center	>= 8.5.2	Affected
Atlassian	Confluence Data Center	>= 8.5.3	Affected
Atlassian	Confluence Data Center	>= 8.5.4	Unaffected
Atlassian	Confluence Data Center	>= 8.6.0	Unaffected
Atlassian	Confluence Data Center	>= 8.7.1	Unaffected
Atlassian	Confluence Server	< 8.0.0	Unaffected
Atlassian	Confluence Server	>= 8.0.0	Affected
Atlassian	Confluence Server	>= 8.1.0	Affected
Atlassian	Confluence Server	>= 8.2.0	Affected
Atlassian	Confluence Server	>= 8.3.0	Affected
Atlassian	Confluence Server	>= 8.4.0	Affected
Atlassian	Confluence Server	>= 8.5.0	Affected
Atlassian	Confluence Server	>= 8.5.1	Affected
Atlassian	Confluence Server	>= 8.5.2	Affected
Atlassian	Confluence Server	>= 8.5.3	Affected

CVE References

confluence.atlassian.com/pages/viewpage.action confluence.atlassian.com · CVE Record https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615
jira.atlassian.com/browse/CONFSERVER-93833 jira.atlassian.com · CVE Record https://jira.atlassian.com/browse/CONFSERVER-93833
packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injec... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2024-01-24 00:00 UTC
The Shadowserver	2026-06-01 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22527.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22527.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0 10.0 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2024-01-24 00:00:00 UTC · CISA

Used in malware

Recorded 2024-01-24 00:00:00 UTC · CISA

Proof of concept available

Recorded 2024-01-16 08:46:21 UTC · GitHub

Weaknesses (CWE)

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_rce_cve_2023_22527.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22527.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

M0untainShley/CVE-2023-22527-MEMSHELL

github · Created 2024-02-26 02:34:44 UTC · 40 stars

confluence CVE-2023-22527 漏洞利用工具，支持冰蝎/哥斯拉内存马注入，支持设置 http 代理

Boogipop/CVE-2023-22527-Godzilla-MEMSHELL

github · Created 2024-02-11 16:46:55 UTC · 74 stars

CVE-2023-22527 内存马注入工具

adminlove520/CVE-2023-22527

github · Created 2024-01-25 10:52:39 UTC · 5 stars

CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server PoC

Privia-Security/CVE-2023-22527

github · Created 2024-01-24 21:29:59 UTC · 4 stars

CVE-2023-22527

yoryio/CVE-2023-22527

github · Created 2024-01-24 04:44:59 UTC · 4 stars

Exploit for CVE-2023-22527 - Atlassian Confluence Data Center and Server

RevoltSecurities/CVE-2023-22527

github · Created 2024-01-23 17:07:15 UTC · 10 stars

An Exploitation tool to exploit the confluence server that are vulnerable to CVE-2023-22527 leads to RCE

Chocapikk/CVE-2023-22527

github · Created 2024-01-23 10:55:28 UTC · 10 stars

Atlassian Confluence - Remote Code Execution

Niuwoo/CVE-2023-22527

github · Created 2024-01-23 09:28:53 UTC · 2 stars

POC

C1ph3rX13/CVE-2023-22527

github · Created 2024-01-23 08:53:46 UTC · 4 stars

Atlassian Confluence - Remote Code Execution (CVE-2023-22527)

Vozec/CVE-2023-22527

github · Created 2024-01-23 08:06:15 UTC · 12 stars

This repository presents a proof-of-concept of CVE-2023-22527

VNCERT-CC/CVE-2023-22527-confluence

github · Created 2024-01-23 07:10:55 UTC · 19 stars

[Confluence] CVE-2023-22527 realworld poc

Manh130902/CVE-2023-22527-POC

github · Created 2024-01-23 02:17:36 UTC · 21 stars

A critical severity Remote Code Execution (RCE) vulnerability (CVE-2023-22527) was discovered in Confluence Server and Data Center.

thanhlam-attt/CVE-2023-22527

github · Created 2024-01-22 19:02:59 UTC · 5 stars

Drun1baby/CVE-2023-22527

github · Created 2024-01-22 11:38:55 UTC · 2 stars

ga0we1/CVE-2023-22527_Confluence_RCE

github · Created 2024-01-17 10:21:00 UTC · 1 stars

CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server PoC

Sudistark/patch-diff-CVE-2023-22527

github · Created 2024-01-16 13:50:49 UTC · 3 stars

Avento/CVE-2023-22527_Confluence_RCE

github · Created 2024-01-16 08:46:21 UTC · 24 stars

CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server PoC

Atlassian Confluence - Remote Code Execution

nuclei · Created Unknown

atlassian_confluence_rce_cve_2023_22527

metasploit · Created Unknown

Metasploit module for CVE-2023-22527

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
24 Jan 2024 00:00 UTC over 2 years ago

24 Jan 2024 00:00 UTC · over 2 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
24 Jan 2024 00:00 UTC over 2 years ago

24 Jan 2024 00:00 UTC · over 2 years ago

First public exploitation report

Exploit observed in malware
16 Jan 2024 08:46 UTC over 2 years ago

16 Jan 2024 08:46 UTC · over 2 years ago

Public PoC available

Public proof-of-concept code published
16 Jan 2024 05:00 UTC over 2 years ago

16 Jan 2024 05:00 UTC · over 2 years ago

CVE published

Vulnerability disclosed publicly
1 Jan 2023 00:01 UTC over 3 years ago

1 Jan 2023 00:01 UTC · over 3 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2023-22527

{
  "cve_id": "CVE-2023-22527",
  "title": "A template injection vulnerability on older versions of Confluence Data Cente...",
  "affected_vendor": "Atlassian",
  "affected_product": "Confluence Data Center, Confluence Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99984,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2023-22527

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API