Atlassian · Confluence Server and Data Server
CVE-2019-3396
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
O que é
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
CISA: Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 3 de maio de 2022
- Adicionada à lista da CISA
- 3 de novembro de 2021
- Publicada
- 25 de março de 2019
- Gravidade
- Crítica 9,8 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 99,9% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-22
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (5)
- https://jira.atlassian.com/browse/CONFSERVER-57974
- http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Inj…
- http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
- https://www.exploit-db.com/exploits/46731/
- http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html
Mais falhas exploradas de Atlassian
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 15 de out. de 2026 | Files or Directories Accessible to External Parties | Multiple Products | Crítica 9,3 | 99,5% |
| 12 de nov. de 2024 | Path Traversal | Jira Server and Data Center | Média 5,3 | >99,9% |
| 24 de jan. de 2024 | Template Injection | Confluence Data Center and Server | Crítica 10,0 | >99,9% |
| 7 de nov. de 2023 | Improper Authorization | Confluence Data Center and Server | Crítica 10,0 | >99,9% |
| 5 de out. de 2023 | Broken Access Control | Confluence Data Center and Server | Crítica 10,0 | 99,2% |
| 30 de set. de 2022 | Command Injection | Bitbucket Server and Data Center | Alto 8,8 | 99,1% |
| 29 de jul. de 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Crítica 9,8 | 98% |
| 2 de jun. de 2022 | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | Crítica 9,8 | >99,9% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.