⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2019-3398

CWE-22Path Traversal9 documents8 sources
Severity
8.8HIGH
EPSS
93.9%
top 0.13%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedApr 18
KEV addedNov 3
KEV dueMay 3
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confl

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

NVDatlassian/confluence_server2.06.6.13+4
CVEListV5atlassian/confluence2.0.0unspecified+9

Patches

🔴Vulnerability Details

3
GHSA
GHSA-qv34-rfhx-fg2q: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource2022-05-24
CVEList
CVE-2019-3398: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource2019-04-18
VulnCheck
Atlassian Confluence Server and Data Center Path Traversal Vulnerability2019

💥Exploits & PoCs

3
Exploit-DB
Atlassian Confluence 6.15.1 - Directory Traversal2019-11-12
Exploit-DB
Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)2019-11-12
Nuclei
Atlassian Confluence Download Attachments - Remote Code Execution

🔍Detection Rules

1
Suricata
ET EXPLOIT Confluence Server Path Traversal Vulnerability (CVE-2019-3398)2021-10-27

📋Vendor Advisories

1
CISA
Atlassian Confluence Server and Data Center Path Traversal Vulnerability2021-11-03