CVEvulnerability

CVE-2019-3395

9.8 CRITICAL Published 2019-03-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-918

Description

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery.

Affected configurations

• atlassian confluence (< 6.6.12) • atlassian confluence (>= 6.7.0 < 6.12.3) • atlassian confluence server (>= 6.13.0 < 6.13.3) • atlassian confluence server (>= 6.14.0 < 6.14.2)

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References