Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2019-3396
HistoryMar 25, 2019 - 7:29 p.m.

CVE-2019-3396

2019-03-2519:29:00
CWE-22
[email protected]
web.nvd.nist.gov
1907
In Wild
7
cve-2019-3396
widget connector
atlassian confluence server
path traversal
remote code execution
server-side template injection

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

100.0%

JSON

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Social References

More

Related

githubexploit 8
nessus 7
prion 1
checkpoint_advisories 1
hackerone 5
packetstorm 2
trendmicroblog 2
fireeye 3
nuclei 1
metasploit 1
attackerkb 2
securelist 1
threatpost 3
dsquare 1
cvelist 1
canvas 1
zdt 1
cisa_kev 1
exploitdb 2
atlassian 4
thn 2
qualysblog 2
ics 2
githubexploit
githubexploit
Exploit for Path Traversal in Atlassian Confluence
2019-04-09 06:20:51
Exploit for Path Traversal in Atlassian Confluence
2021-02-01 16:10:27
Exploit for Path Traversal in Atlassian Confluence
2019-07-01 09:35:17
nessus
nessus
Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection
2019-04-11 00:00:00
Atlassian Confluence < 6.6.12 Multiple Vulnerabilities
2019-07-17 00:00:00
Atlassian Confluence 6.7.x < 6.12.3 Multiple Vulnerabilities
2019-07-17 00:00:00
prion
prion
Path traversal
2019-03-25 19:29:00
checkpoint_advisories
checkpoint_advisories
Atlassian Confluence and Data Center Remote Code Execution (CVE-2019-3396)
2019-04-14 00:00:00
hackerone
hackerone
Mail.ru: RCE on shared.mail.ru due to "widget" plugin
2019-03-29 10:45:58
Mail.ru: Path traversal, SSTI and RCE on a MailRu acquisition
2019-04-11 20:10:37
U.S. Dept Of Defense: LFI with potential to RCE on ██████ using CVE-2019-3396
2019-04-15 19:06:19
packetstorm
packetstorm
Atlassian Confluence Widget Connector Macro Velocity Template Injection
2019-04-18 00:00:00
Atlassian Confluence 6.12.1 Template Injection
2021-01-22 00:00:00
trendmicroblog
trendmicroblog
This Week in Security News: BEC Attacks and Botnet Malware
2019-05-03 14:00:25
This Week in Security News: Skimming Attacks and Ransomware
2019-05-10 13:00:42
fireeye
fireeye
GAME OVER: Detecting and Stopping an APT41 Operation
2019-08-19 00:00:00
This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits
2020-03-25 00:00:00
Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two
2020-04-13 00:00:00
nuclei
nuclei
Atlassian Confluence Server - Path Traversal
2020-07-07 07:24:27
metasploit
metasploit
Atlassian Confluence Widget Connector Macro Velocity Template Injection
2019-04-11 12:55:51
attackerkb
attackerkb
CVE-2019-3396
2019-10-30 00:00:00
Confluence Unauthorized RCE Vulnerability
2019-03-25 00:00:00
securelist
securelist
MATA: Multi-platform targeted malware framework
2020-07-22 10:00:57
threatpost
threatpost
Lazarus Group Surfaces with Advanced Malware Framework
2020-07-22 16:43:44
Hezbollah-Linked Lebanese Cedar APT Infiltrates Hundreds of Servers
2021-02-01 21:18:09
Bug Parade: NSA Warns on Cresting China-Backed Cyberattacks
2020-10-21 20:31:17
dsquare
dsquare
Confluence File Disclosure
2019-03-28 00:00:00
cvelist
cvelist
CVE-2019-3396
2019-03-20 00:00:00
canvas
canvas
Immunity Canvas: CONFLUENCE_MACRO_LFI
2019-03-25 19:29:00
zdt
zdt
Atlassian Confluence Widget Connector Macro Velocity Template Injection Exploit
2019-04-18 00:00:00
cisa_kev
cisa_kev
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
2021-11-03 00:00:00
exploitdb
exploitdb
Atlassian Confluence Widget Connector Macro - SSTI
2021-01-22 00:00:00
Atlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)
2019-04-19 00:00:00
atlassian
atlassian
Remote code execution via Widget Connector macro - CVE-2019-3396
2019-02-28 03:02:04
SSRF via WebDAV endpoint - CVE-2019-3395
2019-02-27 22:52:13
Remote code execution via Widget Connector macro - CVE-2019-3396
2019-02-28 03:02:04
thn
thn
Hezbollah Hacker Group Targeted Telecoms, Hosting, ISPs Worldwide
2021-01-29 10:08:00
Top 30 Critical Security Vulnerabilities Most Exploited by Hackers
2021-07-29 08:21:00
qualysblog
qualysblog
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
2019-12-27 18:01:22
NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities
2020-10-22 23:10:29
ics
ics
Top Routinely Exploited Vulnerabilities
2021-08-20 12:00:00
Potential for China Cyber Response to Heightened U.S.–China Tensions
2020-10-20 12:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

100.0%

JSON
Related for CVE-2019-3396
githubexploit8nessus7prion1checkpoint_advisories1hackerone5packetstorm2trendmicroblog2fireeye3nuclei1metasploit1attackerkb2securelist1threatpost3dsquare1cvelist1canvas1zdt1cisa_kev1exploitdb2atlassian4thn2qualysblog2ics2