← Vulnerability feed

Vulnerability record · CVE-2023-22524 · published 6 December 2023

CVE-2023-22524: Atlassian companion vulnerability

Atlassian · Companion

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code.

9.8 CVSS 3.1 Critical EPSS 25% · top 2.2%
9.8CVSS 3.1 base score
25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://confluence.atlassian.com/security/cve-2023-22524-rce-vulnerability-in-atlassian-companion-app-for-macos-13192494 Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-93518 Vendor Advisory
https://confluence.atlassian.com/security/cve-2023-22524-rce-vulnerability-in-atlassian-companion-app-for-macos-13192494 Vendor Advisory
https://jira.atlassian.com/browse/CONFSERVER-93518 Vendor Advisory

Track CVE-2023-22524 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2020-4019Atlassian companion untrusted search path vulnerabilityThe file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different executable …EPSS 0.35%7.2CVE-2020-4020Atlassian companion vulnerabilityThe file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Server insta…EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2023-22524), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.