Confluence Server vulnerabilitiesAnd the versions its exploited flaws hit.
Confluence Server is made by Atlassian. We track 47 published vulnerabilities in it, across 490 versions. 9 of them are on the list of flaws known to be exploited, the newest added on 24 January 2024. If you run Confluence Server, check your version against the exploited flaws below and patch those first.
The most recent Confluence Server flaw added to the known-exploited list is CVE-2023-22527, on 24 January 2024. We keep watching the known-exploited list.
Which versions of Confluence Server do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "8.0.0 to before 8.5.4" means from 8.0.0 up to, but not including, 8.5.4. Find your version, then patch.
- CVE-2023-22527Exploited list, 24 Jan 2024
Atlassian Confluence Data Center and Server Template Injection Vulnerability
8.0.0 to before 8.5.4 - CVE-2023-22518Exploited list, 7 Nov 2023
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
1.0 to before 7.19.167.20.0 to before 8.3.48.4.0 to before 8.4.48.5.0 to before 8.5.38.6.0 - CVE-2023-22515Exploited list, 5 Oct 2023
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
8.0.0 to before 8.3.38.4.0 to before 8.4.38.5.0 to before 8.5.2 - CVE-2022-26134Exploited list, 2 Jun 2022
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
1.3 to before 7.4.177.13.0 to before 7.13.77.14.0 to before 7.14.37.15.0 to before 7.15.27.16.0 to before 7.16.47.17.0 to before 7.17.47.18.0 - CVE-2021-26085Exploited list, 28 Mar 2022
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
before 7.4.107.5.0 to before 7.12.3 - CVE-2019-3396Exploited list, 3 Nov 2021
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
before 6.6.126.7.0 to before 6.12.36.13.0 to before 6.13.36.14.0 to before 6.14.2 - CVE-2021-26084Exploited list, 3 Nov 2021
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
before 6.13.236.14.0 to before 7.4.117.5.0 to before 7.11.67.12.0 to before 7.12.5 - CVE-2019-3398Exploited list, 3 Nov 2021
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
2.0 to before 6.6.136.7.0 to before 6.12.46.13.0 to before 6.13.46.14.0 to before 6.14.36.15.0 to before 6.15.2
1 more exploited flaw names Confluence Server without a version of its own, for example as the system other affected software runs on. It is in the list below.
Which Confluence Server vulnerabilities are being exploited?
9 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8Atlassian Confluence Data Center and Server Template Injection Vulnerability
Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
- 9.8Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker.
- 9.8Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
- 9.8Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext.
- 9.8Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
- 5.3Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
- 9.8Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.
- 9.8Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
Which Confluence Server flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
- >99%
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
- >99%
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.
- >99%
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance.
- >99%
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint.
- >99%
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the...
- >99%
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server...
- 98%
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password.
- 97%
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource.
- 88%CVE-2024-21683High
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.
Running Confluence Server? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
- Matched to
- Confluence Server on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 47 published vulnerabilities listed under the name Confluence Server, across 490 versions. The most recent Confluence Server flaw added to the known-exploited list is CVE-2023-22527, on 24 January 2024.
9 are on the list of flaws known to be exploited. The most recently added are CVE-2023-22527, CVE-2023-22518 and CVE-2023-22515.
Each flaw names its own versions, usually as ranges. The newest, CVE-2023-22527, affects 8.0.0 to before 8.5.4. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Confluence Server. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.