{"id":"CVE-2023-22523","state":"PUBLISHED","title":"This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exis","description":"This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.","publishedAt":"2023-12-06T05:00:02.793Z","updatedAt":"2026-02-25T16:52:39.413Z","severity":{"score":9.8,"label":"Critical","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"atlassian"},"assigner":"atlassian","products":["Atlassian Assets Discovery Cloud","Atlassian Assets Discovery Data Center"],"affected":[{"vendor":"Atlassian","product":"Assets Discovery Cloud","versions":[{"version":"< 1.0.0","status":"unaffected"},{"version":">= 1.0.0","status":"affected"},{"version":">= 1.5.7.0","status":"affected"},{"version":">= 1.5.7.1","status":"affected"},{"version":">= 1.5.7.3","status":"affected"},{"version":">= 1.5.7.4","status":"affected"},{"version":">= 1.6.1.2","status":"affected"},{"version":">= 1.6.2.0","status":"affected"},{"version":">= 1.6.3.0","status":"affected"},{"version":">= 1.6.4.0","status":"affected"},{"version":">= 1.6.4.4","status":"affected"},{"version":">= 1.7.0.0","status":"affected"},{"version":">= 1.7.1.0","status":"affected"},{"version":">= 1.7.2.0","status":"affected"},{"version":">= 1.8.0.0","status":"affected"},{"version":">= 1.8.1.1","status":"affected"},{"version":">= 1.8.1.2","status":"affected"},{"version":">= 1.8.1.3","status":"affected"},{"version":">= 1.8.1.4","status":"affected"},{"version":">= 1.8.1.5","status":"affected"},{"version":">= 1.8.2.0","status":"affected"},{"version":">= 2.0.0.0","status":"affected"},{"version":">= 3.1.0","status":"affected"},{"version":">= 3.1.1","status":"affected"},{"version":">= 3.1.10","status":"affected"},{"version":">= 3.1.11","status":"affected"},{"version":">= 3.1.2","status":"affected"},{"version":">= 3.1.3","status":"affected"},{"version":">= 3.1.4","status":"affected"},{"version":">= 3.1.5","status":"affected"},{"version":">= 3.1.6","status":"affected"},{"version":">= 3.1.7","status":"affected"},{"version":">= 3.1.8","status":"affected"},{"version":">= 3.1.9","status":"affected"},{"version":">= 3.2.0","status":"unaffected"}]},{"vendor":"Atlassian","product":"Assets Discovery Data Center","versions":[{"version":"< 1.0.0","status":"unaffected"},{"version":">= 1.0.0","status":"affected"},{"version":">= 3.1.0","status":"affected"},{"version":">= 3.1.1","status":"affected"},{"version":">= 3.1.10","status":"affected"},{"version":">= 3.1.11","status":"affected"},{"version":">= 3.1.2","status":"affected"},{"version":">= 3.1.3","status":"affected"},{"version":">= 3.1.4","status":"affected"},{"version":">= 3.1.5","status":"affected"},{"version":">= 3.1.6","status":"affected"},{"version":">= 3.1.7","status":"affected"},{"version":">= 3.1.9","status":"affected"},{"version":">= 6.0.0","status":"affected"},{"version":">= 6.1.10","status":"affected"},{"version":">= 6.1.11","status":"affected"},{"version":">= 6.1.12","status":"affected"},{"version":">= 6.1.13","status":"affected"},{"version":">= 6.1.14","status":"affected"},{"version":">= 6.1.9","status":"affected"},{"version":">= 6.2.0","status":"unaffected"}]}],"references":["https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html","https://jira.atlassian.com/browse/JSDSERVER-14925"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/22xxx/CVE-2023-22523.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-22523","state":"PUBLISHED","datePublished":"2023-12-06T05:00:02.793Z","dateUpdated":"2026-02-25T16:52:39.413Z","assignerShortName":"atlassian","assignerOrgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","dateReserved":"2023-01-01T00:01:22.333Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent."}],"affected":[{"vendor":"Atlassian","product":"Assets Discovery Cloud","versions":[{"version":"< 1.0.0","status":"unaffected"},{"version":">= 1.0.0","status":"affected"},{"version":">= 1.5.7.0","status":"affected"},{"version":">= 1.5.7.1","status":"affected"},{"version":">= 1.5.7.3","status":"affected"},{"version":">= 1.5.7.4","status":"affected"},{"version":">= 1.6.1.2","status":"affected"},{"version":">= 1.6.2.0","status":"affected"},{"version":">= 1.6.3.0","status":"affected"},{"version":">= 1.6.4.0","status":"affected"},{"version":">= 1.6.4.4","status":"affected"},{"version":">= 1.7.0.0","status":"affected"},{"version":">= 1.7.1.0","status":"affected"},{"version":">= 1.7.2.0","status":"affected"},{"version":">= 1.8.0.0","status":"affected"},{"version":">= 1.8.1.1","status":"affected"},{"version":">= 1.8.1.2","status":"affected"},{"version":">= 1.8.1.3","status":"affected"},{"version":">= 1.8.1.4","status":"affected"},{"version":">= 1.8.1.5","status":"affected"},{"version":">= 1.8.2.0","status":"affected"},{"version":">= 2.0.0.0","status":"affected"},{"version":">= 3.1.0","status":"affected"},{"version":">= 3.1.1","status":"affected"},{"version":">= 3.1.10","status":"affected"},{"version":">= 3.1.11","status":"affected"},{"version":">= 3.1.2","status":"affected"},{"version":">= 3.1.3","status":"affected"},{"version":">= 3.1.4","status":"affected"},{"version":">= 3.1.5","status":"affected"},{"version":">= 3.1.6","status":"affected"},{"version":">= 3.1.7","status":"affected"},{"version":">= 3.1.8","status":"affected"},{"version":">= 3.1.9","status":"affected"},{"version":">= 3.2.0","status":"unaffected"}]},{"vendor":"Atlassian","product":"Assets Discovery Data Center","versions":[{"version":"< 1.0.0","status":"unaffected"},{"version":">= 1.0.0","status":"affected"},{"version":">= 3.1.0","status":"affected"},{"version":">= 3.1.1","status":"affected"},{"version":">= 3.1.10","status":"affected"},{"version":">= 3.1.11","status":"affected"},{"version":">= 3.1.2","status":"affected"},{"version":">= 3.1.3","status":"affected"},{"version":">= 3.1.4","status":"affected"},{"version":">= 3.1.5","status":"affected"},{"version":">= 3.1.6","status":"affected"},{"version":">= 3.1.7","status":"affected"},{"version":">= 3.1.9","status":"affected"},{"version":">= 6.0.0","status":"affected"},{"version":">= 6.1.10","status":"affected"},{"version":">= 6.1.11","status":"affected"},{"version":">= 6.1.12","status":"affected"},{"version":">= 6.1.13","status":"affected"},{"version":">= 6.1.14","status":"affected"},{"version":">= 6.1.9","status":"affected"},{"version":">= 6.2.0","status":"unaffected"}]}],"references":[{"url":"https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html"},{"url":"https://jira.atlassian.com/browse/JSDSERVER-14925"}],"metrics":[{"cvssV3_0":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"description":"RCE (Remote Code Execution)","lang":"en","type":"RCE (Remote Code Execution)"}]}],"providerMetadata":{"shortName":"atlassian","orgId":"f08a6ab8-ed46-4c22-8884-d911ccfe3c66","dateUpdated":"2023-12-06T15:30:00.483Z"},"credits":[{"lang":"en","value":"Bug Bounty"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html","tags":["x_transferred"]},{"url":"https://jira.atlassian.com/browse/JSDSERVER-14925","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T10:13:48.923Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2023-12-14T05:00:08.551203Z","id":"CVE-2023-22523","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-25T16:52:39.413Z"}}]}}}