Atlassian Confluence Server
En bref
- Source
- NVD
- EPSS
- EPSS 99.91 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- atlassian
- Statut NVD
- Analyzed
Description
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
- https://jira.atlassian.com/browse/CONFSERVER-57974
- http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html
- http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
- https://www.exploit-db.com/exploits/46731/
- http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3396
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-13035
- GCVE · GCVE-0-2019-3396
Configurations affectées (CPE NVD)
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*< 6.6.12cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 6.7.0 < 6.12.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 6.13.0 < 6.13.3cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*≥ 6.14.0 < 6.14.2
Produits affectés
| Produit | Versions |
|---|---|
| Atlassian · Confluence Server | affected unspecified < 6.6.12 ; affected 6.7.0 < unspecified ; affected unspecified < 6.12.3 ; affected next of 6.13.0 < unspecified ; affected unspecified < 6.13.3 ; affected next of 6.14.0 < unspecified |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |