Were out-of-dated versions like 5.x, 7.1.x, 7.4.x be affected by CVE-2023-22527?
Asked by dearjane_fan:

When this Critical severity RCE (Remote Code Execution) vulnerability was introduced? If the versions of my instances were 5.x, 7.1.x, 7.4.x, what else can I do except upgrading to 8.x? Or am I be affected by CVE-2023-22527?


Answers:
author: James Ponting
body: Hi [@dearjane_fan](/t5/user/viewprofilepage/user-id/5407053)

Please review the advisory we sent for [CVE-2023-22527](https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html). It explicitly lists the impacted versions.

No versions prior to Confluence 8.0.0 are known to be impacted. The above listed versions should be fine, though I would note they're all impacted by other critical and high severity CVEs, and I would recommend upgrading to the latest Confluence 8.5.x LTS release if possible.

Thanks,   
James Ponting   
Engineering Manager - Confluence Data Center

comments: author: Charlie Marriott
body: Hi [@dearjane_fan](/t5/user/viewprofilepage/user-id/5407053),

It's also worth saying that there are a significant number of functional improvements you will benefit from by upgrading Confluence:

* [7.19 LTS \> 8.5 LTS](https://confluence.atlassian.com/doc/confluence-8-5-long-term-support-release-change-log-1276870737.html)
* [7.13 LTS \> 7.19 LTS](https://confluence.atlassian.com/doc/confluence-7-19-long-term-support-release-change-log-1141976791.html)
* [7.4 LTS \> 7.13 LTS](https://confluence.atlassian.com/doc/confluence-7-13-long-term-support-release-change-log-1044114094.html)
* [6.7 \> 6.13 LTS](https://confluence.atlassian.com/doc/confluence-6-13-long-term-support-release-change-log-959288815.html)

Your 5.x upgrade is likely to involve the most effort as you will need to first move to **7.19.x**:

![Screenshot 2024-01-15 at 11.34.05?am.png](https://community.atlassian.com/t5/image/serverpage/image-id/300506i665C918F452140CB/image-size/large?v=v2&px=999 "Screenshot 2024-01-15 at 11.34.05?am.png")

Please see the following documentation to assist with your upgrade:

* [Upgrading Confluence](https://confluence.atlassian.com/doc/upgrading-confluence-4578.html)
* [7.19 upgrade procedure](https://confluence.atlassian.com/doc/confluence-7-19-upgrade-notes-1141976787.html#Confluence7.19UpgradeNotes-Upgradeprocedure)
* [Confluence Server \& Data Center download archives](https://www.atlassian.com/software/confluence/download-archives)

I hope that helps!

Charlie


author: dearjane_fan
body: [@James Ponting](/t5/user/viewprofilepage/user-id/1187310) Thanks a lot!


author: dearjane_fan
body: it would be helpful. Thank you [@Charlie Marriott](/t5/user/viewprofilepage/user-id/616774)


author: Ste Wright
body: Hi [@dearjane_fan](/t5/user/viewprofilepage/user-id/5407053)

As the CVE mentions "out of date" versions, I'd recommend upgrading to be safe. Is there a reason you don't want to do this?

Ste

comments: author: dearjane_fan
body: Lol. Cause managers always say **we cannot upgrade due to kinds of unsolved problems** . Instead of upgrading the whole app, they would rather use minimal operations such as patches. But thanks a lot [@Ste Wright](/t5/user/viewprofilepage/user-id/1166470)


Tags: confluence-server

server