All vulnerabilities
CVE-2019-3398

Atlassian Confluence Server and Data Center Path Traversal Vulnerability

Atlassian Confluence Server and Data CenterApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 3 Nov 2021CISA KEV
Exploit odds (EPSS)97.0%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.6.13Also 6.12.4, 6.13.4 and 2 moreCVE List
Federal deadline3 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 18 Apr 2019, 17:21 UTCPublishedCVE List
  2. 12 Nov 2019Exploit code publicExploit-DB
  3. 3 Nov 2021Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Webapps exploitAtlassian Confluence 6.15.1 - Directory Traversal 12 Nov 2019Exploit-DB
  • Scanner templateAtlassian Confluence Download Attachments - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.

Text from CVE List

Affected versions 10

  • Confluenceaffected: 2.0.0 before unspecifiedCVE List
  • Confluenceaffected: unspecified before 6.6.13CVE List
  • Confluenceaffected: 6.7.0 before unspecifiedCVE List
  • Confluenceaffected: unspecified before 6.12.4CVE List
  • Confluenceaffected: 6.13.0 before unspecifiedCVE List
  • Confluenceaffected: unspecified before 6.13.4CVE List
  • Confluenceaffected: 6.14.0 before unspecifiedCVE List
  • Confluenceaffected: unspecified before 6.14.3CVE List
  • Confluenceaffected: 6.15.0 before unspecifiedCVE List
  • Confluenceaffected: unspecified before 6.15.2CVE List

References 4