NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2019-3396

Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Affected products

VendorProductAffected versions
AtlassianConfluence Server
before 6.6.12
from 6.7.0 before 6.12.3
from 6.13.0 before 6.13.3
from 6.14.0 before 6.14.2

Weakness classification

CWE-22

References