Log in Start free

Actively exploited · Published Apr 18, 2019 · Assigned by atlassian

CVE-2019-3398

High 8.8 Exploited

In plain English

A high-severity path traversal in Confluence from Atlassian. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 97.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)97.0%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.

Affected products (as reported)

VendorProductVersions
Atlassian Confluence 2.0.0 – before unspecifiedunspecified – before 6.6.136.7.0 – before unspecifiedunspecified – before 6.12.46.13.0 – before unspecifiedunspecified – before 6.13.46.14.0 – before unspecifiedunspecified – before 6.14.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References