Actively exploited in the wild
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Atlassian - Confluence Server and Data Center · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-3398
HighCVSS 8.8KEVSummary
A path traversal vulnerability in the downloadallattachments resource in Confluence Server and Data Center. It allows writing files to arbitrary locations, potentially leading to remote code execution.
Risk Assessment
An attacker with appropriate permissions can write malicious files to the server, potentially leading to system compromise.
Recommendation
Update Confluence Server or Data Center to a patched version (e.g., 6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2).
Other vulnerabilities in Confluence Server and Data Center
See all- CVE-2022-26134CriticalActively exploited
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that allows an unauthenticated attacker to execute arbitrary code on the instance. Affected versions range from 1.3.0 before 7.4.17, 7.13.0 before 7.13.7, 7.14.0 before 7.14.3, 7.15.0 before 7.15.2, 7.16.0 before 7.16.4, 7.17.0 before 7.17.4, and 7.18.0 before 7.18.1.
- CVE-2021-26084CriticalActively exploited
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
Original NVD description (English source)
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.