CVE-2019-3396
Published: 25 March 2019
Summary
CVE-2019-3396 is a critical-severity Path Traversal (CWE-22) vulnerability in Atlassian Confluence Server. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
The vulnerability is a path traversal flaw combined with server-side template injection in the Widget Connector macro of Atlassian Confluence Server and Data Center. It affects versions prior to 6.6.12, 6.12.3, 6.13.3, and 6.14.2, and is tracked under CWE-22 with a CVSS score of 9.8.
Unauthenticated remote attackers can supply a malicious template to the macro, traverse the filesystem, and execute arbitrary code on the underlying server, resulting in full compromise of the Confluence instance.
Publicly available references, including the Atlassian Jira advisory CONFSERVER-57974 and Rapid7 Metasploit module, document the fixed versions and provide exploit code confirming remote code execution is achievable without authentication.
Multiple working exploits have been published on Exploit-DB and Packet Storm, indicating the issue has been actively weaponized since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-13035
Vulnerability details
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0…
more
before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted macro input to block the path traversal and server-side template injection that enables unauthenticated RCE.
Enforces access control on the Widget Connector macro so that unauthenticated remote attackers cannot reach the vulnerable template-processing code path.
Mandates timely application of vendor patches that close the path-traversal/template-injection flaw in the affected Confluence versions.