PT-2019-5256 · Atlassian · Confluence

David Black · Publicado 2019-04-18 · Atualizado 2025-10-24 · CVE-2019-3398

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Confluence Server versions 2.0.0 through 6.6.12 Confluence Server versions 6.7.0 through 6.12.3 Confluence Server versions 6.13.0 through 6.13.3 Confluence Server versions 6.14.0 through 6.14.2 Confluence Server versions 6.15.0 through 6.15.1 Confluence Data Center versions 2.0.0 through 6.6.12 Confluence Data Center versions 6.7.0 through 6.12.3 Confluence Data Center versions 6.13.0 through 6.13.3 Confluence Data Center versions 6.14.0 through 6.14.2 Confluence Data Center versions 6.15.0 through 6.15.1

Description A path traversal vulnerability exists in the downloadallattachments resource of Confluence Server and Data Center. This vulnerability can be exploited by a remote attacker who has permission to add attachments to pages and/or blogs, create a new space or personal space, or has 'Admin' permissions for a space. The attacker can write files to arbitrary locations, potentially leading to remote code execution on systems running a vulnerable version of Confluence Server or Data Center.

Recommendations For Confluence Server versions 2.0.0 through 6.6.12, update to version 6.6.13 or later. For Confluence Server versions 6.7.0 through 6.12.3, update to version 6.12.4 or later. For Confluence Server versions 6.13.0 through 6.13.3, update to version 6.13.4 or later. For Confluence Server versions 6.14.0 through 6.14.2, update to version 6.14.3 or later. For Confluence Server versions 6.15.0 through 6.15.1, update to version 6.15.2 or later. For Confluence Data Center versions 2.0.0 through 6.6.12, update to version 6.6.13 or later. For Confluence Data Center versions 6.7.0 through 6.12.3, update to version 6.12.4 or later. For Confluence Data Center versions 6.13.0 through 6.13.3, update to version 6.13.4 or later. For Confluence Data Center versions 6.14.0 through 6.14.2, update to version 6.14.3 or later. For Confluence Data Center versions 6.15.0 through 6.15.1, update to version 6.15.2 or later.

Exploit

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2020-02108

CVE-2019-3398

Produtos afetados

Confluence

Referências · 17

• 🔥 https://github.com/superevr/cve-2019-3398 · Exploit
• 🔥 http://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html · Exploit
• 🔥 https://exploit-db.com/exploits/47621 · Exploit
• https://bdu.fstec.ru/vul/2020-02108 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-3398 · Nota de Segurança
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3398 · Nota
• http://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.html · Nota
• https://t.me/cveNotify/140164 · Publicação no Telegram
• https://xakep.ru/2020/04/24/web-shells · Nota
• https://jira.atlassian.com/browse/CONFSERVER-58102 · Aviso do Fabricante
• http://securityfocus.com/bid/108067 · Nota
• https://seclists.org/bugtraq/2019/Apr/33 · Nota
• http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html · Nota
• https://osv.dev/vulnerability/CVE-2019-3398 · Aviso do Fabricante
• https://t.me/cvenotify/110649 · Publicação no Telegram