CVEvulnerability

CVE-2019-3396

9.8 CRITICAL Known exploited Published 2019-03-25 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability — Atlassian Confluence Server and Data Server

Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2019-3396
Status
Analyzed
Published
2019-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-22

Description

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Affected configurations

• atlassian confluence server (< 6.6.12) • atlassian confluence server (>= 6.7.0 < 6.12.3) • atlassian confluence server (>= 6.13.0 < 6.13.3) • atlassian confluence server (>= 6.14.0 < 6.14.2)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References