PT-2019-5256 · Atlassian · Confluence

David Black · Published 2019-04-18 · Updated 2025-07-23 · CVE-2019-3398

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions:

Confluence Server versions 2.0.0 through 6.6.12

Confluence Server versions 6.7.0 through 6.12.3

Confluence Server versions 6.13.0 through 6.13.3

Confluence Server versions 6.14.0 through 6.14.2

Confluence Server versions 6.15.0 through 6.15.1

Confluence Data Center versions 2.0.0 through 6.6.12

Confluence Data Center versions 6.7.0 through 6.12.3

Confluence Data Center versions 6.13.0 through 6.13.3

Confluence Data Center versions 6.14.0 through 6.14.2

Confluence Data Center versions 6.15.0 through 6.15.1

Description:

A path traversal vulnerability exists in the downloadallattachments resource of Confluence Server and Data Center. This vulnerability can be exploited by a remote attacker who has permission to add attachments to pages and/or blogs, create a new space or personal space, or has 'Admin' permissions for a space. The attacker can write files to arbitrary locations, potentially leading to remote code execution on systems running a vulnerable version of Confluence Server or Data Center.

Recommendations:

For Confluence Server versions 2.0.0 through 6.6.12, update to version 6.6.13 or later.

For Confluence Server versions 6.7.0 through 6.12.3, update to version 6.12.4 or later.

For Confluence Server versions 6.13.0 through 6.13.3, update to version 6.13.4 or later.

For Confluence Server versions 6.14.0 through 6.14.2, update to version 6.14.3 or later.

For Confluence Server versions 6.15.0 through 6.15.1, update to version 6.15.2 or later.

For Confluence Data Center versions 2.0.0 through 6.6.12, update to version 6.6.13 or later.

For Confluence Data Center versions 6.7.0 through 6.12.3, update to version 6.12.4 or later.

For Confluence Data Center versions 6.13.0 through 6.13.3, update to version 6.13.4 or later.

For Confluence Data Center versions 6.14.0 through 6.14.2, update to version 6.14.3 or later.

For Confluence Data Center versions 6.15.0 through 6.15.1, update to version 6.15.2 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-02108

CVE-2019-3398

Affected Products

Confluence

References · 15

• 🔥 https://github.com/superevr/cve-2019-3398 · Exploit
• 🔥 https://exploit-db.com/exploits/47621 · Exploit
• 🔥 http://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html · Exploit
• https://bdu.fstec.ru/vul/2020-02108 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-3398 · Security Note
• https://jira.atlassian.com/browse/CONFSERVER-58102 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3398 · Security Note
• https://t.me/cvenotify/110649 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• http://securityfocus.com/bid/108067 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3398 · Note
• https://seclists.org/bugtraq/2019/Apr/33 · Note
• http://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.html · Note
• http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html · Note
• https://xakep.ru/2020/04/24/web-shells · Note