Critical severity · published Mar 25, 2019
CVE-2019-3396
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
RansomwareIn wildKEV
9.8
CVSS
99.9%
EPSS
Yes
On KEV
Description
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.9% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useKnown
Affected products
Which versions
CO
Confluence · Atlassian
before 6.6.12; 6.7.0 before unspecified; before 6.12.3; next of 6.13.0 before unspecified; before 6.13.3; next of 6.14.0 before unspecified; +1 more · source: vendor, NVD
CS
Confluence Server and Data Server · Atlassian
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3396
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://jira.atlassian.com/browse/CONFSERVER-57974
x_refsource_MISC
http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html
x_refsource_MISC
http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
exploit
https://www.exploit-db.com/exploits/46731/
x_refsource_MISC
http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html
More from Confluence
9.8
CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
9.8
CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
9.8
CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
9.8
CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
9.8
CVE-2022-26134
Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability