CVE-2019-3398
Path Traversal in Atlassian Confluence Server 2.0 – 6.6.13
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2019-3398 is a high-severity Path Traversal (CWE-22) vulnerability in Atlassian Confluence Server. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource, tracked as CVE-2019-3398 and assigned CWE-22. The flaw affects all versions from 2.0.0 through 6.6.12, 6.7.0 through 6.12.3, 6.13.0 through 6.13.3, 6.14.0 through 6.14.2, and 6.15.0 through 6.15.1, carrying a CVSS 3.1 score of 8.8.
A remote attacker who already holds permission to add attachments to pages or blogs, create a space or personal space, or administer a space can supply crafted input to the affected resource. Successful exploitation allows the attacker to write files to arbitrary locations on the server, which can be leveraged to achieve remote code execution.
Publicly available advisories and exploit references indicate that the issue is resolved by upgrading to Confluence Server and Data Center 6.6.13, 6.12.4, 6.13.4, 6.14.3, or 6.15.2. Multiple proof-of-concept artifacts have been published that demonstrate directory traversal and file-write primitives against the listed vulnerable releases.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-13037
Vulnerability Data
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or…
more
who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.