Were out-of-dated versions like 5.x, 7.1.x, 7.4.x be affected by CVE-2023-22527?

[dearjane_fan]

When this Critical severity RCE (Remote Code Execution) vulnerability was introduced? If the versions of my instances were 5.x, 7.1.x, 7.4.x, what else can I do except upgrading to 8.x? Or am I be affected by CVE-2023-22527?

[James Ponting · Accepted solution]

Hi @dearjane_fan

Please review the advisory we sent for CVE-2023-22527. It explicitly lists the impacted versions.

No versions prior to Confluence 8.0.0 are known to be impacted. The above listed versions should be fine, though I would note they're all impacted by other critical and high severity CVEs, and I would recommend upgrading to the latest Confluence 8.5.x LTS release if possible.

Thanks,
James Ponting
Engineering Manager - Confluence Data Center 

[Charlie Marriott]

Hi @dearjane_fan, 

It's also worth saying that there are a significant number of functional improvements you will benefit from by upgrading Confluence:

• 7.19 LTS > 8.5 LTS
• 7.13 LTS > 7.19 LTS
• 7.4 LTS > 7.13 LTS
• 6.7 > 6.13 LTS

Your 5.x upgrade is likely to involve the most effort as you will need to first move to 7.19.x:

Please see the following documentation to assist with your upgrade:

• Upgrading Confluence
• 7.19 upgrade procedure
• Confluence Server & Data Center download archives

I hope that helps!

Charlie

[dearjane_fan]

@James Ponting Thanks a lot!

[dearjane_fan]

it would be helpful. Thank you @Charlie Marriott 

[Ste Wright]

Hi @dearjane_fan 

As the CVE mentions "out of date" versions, I'd recommend upgrading to be safe. Is there a reason you don't want to do this?

Ste

[dearjane_fan]

Lol. Cause managers always say we cannot upgrade due to kinds of unsolved problems. Instead of upgrading the whole app, they would rather use minimal operations such as patches. But thanks a lot @Ste Wright