CVE-2023-22508
Published: 18 July 2023
Summary
CVE-2023-22508 is a high-severity an unspecified weakness vulnerability in Atlassian Confluence Data Center. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-22508 is a high-severity remote code execution vulnerability that affects Confluence Data Center and Server products. It was introduced in version 6.1.0 and carries a CVSS score of 8.8, enabling an authenticated attacker to execute arbitrary code with high impact to confidentiality, integrity, and availability without requiring user interaction.
An authenticated attacker with network access can exploit the flaw to run arbitrary code on the affected Confluence instance, potentially leading to full compromise of the server.
Atlassian advises upgrading to Confluence 8.2.0 or later, 7.19.8 or later for the 7.19 LTS branch, or 7.13.20 or later for the 7.13 LTS branch. A workaround is available that disables the JMX network port, detailed in Atlassian's knowledge base article. The issue was identified through Atlassian's Bug Bounty program.
The EPSS score reached a peak of 0.0670 from a current value of 0.0515.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-26648
Vulnerability details
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute…
more
arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that you upgrade your instance to avoid this bug using the following options: * Upgrade to a Confluence feature release greater than or equal to 8.2.0 (ie: 8.2, 8.2, 8.4, etc...) * Upgrade to a Confluence 7.19 LTS bugfix release greater than or equal to 7.19.8 (ie: 7.19.8, 7.19.9, 7.19.10, 7.19.11, etc...) * Upgrade to a Confluence 7.13 LTS bugfix release greater than or equal to 7.13.20 (Release available early August) See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html ). You can download the latest version of Data Center & Server from the download center (https://www.atlassian.com/software/confluence/download-archives ). If you are unable to upgrade your instance please use the following guide to workaround the issue https://confluence.atlassian.com/confkb/how-to-disable-the-jmx-network-port-for-cve-2023-22508-1267761550.html This vulnerability was discovered by a private user and reported via our Bug Bounty program.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.