Atlassian Confluence Server
At a glance
- Source
- NVD
- EPSS
- EPSS 99.91 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- atlassian
- NVD status
- Analyzed
Description
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
- https://jira.atlassian.com/browse/CONFSERVER-57974
- http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html
- http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
- https://www.exploit-db.com/exploits/46731/
- http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3396
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-13035
- GCVE · GCVE-0-2019-3396
Affected configurations (NVD CPE)
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*< 6.6.12cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 6.7.0 < 6.12.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 6.13.0 < 6.13.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 6.14.0 < 6.14.2
Affected products
| Product | Versions |
|---|---|
| Atlassian · Confluence Server | affected unspecified < 6.6.12 ; affected 6.7.0 < unspecified ; affected unspecified < 6.12.3 ; affected next of 6.13.0 < unspecified ; affected unspecified < 6.13.3 ; affected next of 6.14.0 < unspecified |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |