Vulnerability Description
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Confluence Server | < 6.6.12 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-ConnectoExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-TemplateExploitThird Party AdvisoryVDB Entry
- http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connectorExploitThird Party AdvisoryVDB Entry
- https://jira.atlassian.com/browse/CONFSERVER-57974Issue TrackingPatchVendor Advisory
- https://www.exploit-db.com/exploits/46731/ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-ConnectoExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-TemplateExploitThird Party AdvisoryVDB Entry
- http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connectorExploitThird Party AdvisoryVDB Entry
- https://jira.atlassian.com/browse/CONFSERVER-57974Issue TrackingPatchVendor Advisory
- https://www.exploit-db.com/exploits/46731/ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-US Government Resource
FAQ
What is CVE-2019-3396?
CVE-2019-3396 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 befo...
How severe is CVE-2019-3396?
CVE-2019-3396 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-3396?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Confluence Server.