Atlassian · Confluence Server and Data Center
CVE-2019-3398
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
What it is
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
CISA: Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- April 18, 2019
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 97% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (6)
- https://jira.atlassian.com/browse/CONFSERVER-58102
- https://seclists.org/bugtraq/2019/Apr/33
- http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html
- http://www.securityfocus.com/bid/108067
- http://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html
- http://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.html
More exploited flaws from Atlassian
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Object-Graph Navigation Language (OGNL) Injection | Confluence Server and Data Center | Critical 9.8 | >99.9% |
| Oct 15, 2026 | Files or Directories Accessible to External Parties | Multiple Products | Critical 9.3 | 99.5% |
| Nov 12, 2024 | Path Traversal | Jira Server and Data Center | Medium 5.3 | >99.9% |
| Jan 24, 2024 | Template Injection | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Nov 7, 2023 | Improper Authorization | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Oct 5, 2023 | Broken Access Control | Confluence Data Center and Server | Critical 10.0 | 99.2% |
| Sep 30, 2022 | Command Injection | Bitbucket Server and Data Center | High 8.8 | 99.1% |
| Jul 29, 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Critical 9.8 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.