CVE-2019-3396

🗓️ 25 Mar 2019 18:37:06Reported by atlassianType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 2205 Views🌐 WEB

Widget Connector macro path traversal and remote code execution in Atlassian Confluence Serve

Reporter	Title	Published	Views	Family All 90
GithubExploit	POC	17 Apr 201909:37	–	githubexploit
GithubExploit	Exploit for Path Traversal in Atlassian Confluence_Server	5 Feb 202116:31	–	githubexploit
GithubExploit	Exploit for Path Traversal in Atlassian Confluence_Server	10 Apr 201902:15	–	githubexploit
GithubExploit	Exploit for Path Traversal in Atlassian Confluence_Server	1 May 202102:10	–	githubexploit
GithubExploit	Exploit for Path Traversal in Atlassian Confluence_Server	16 Sep 202504:50	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Atlassian Confluence_Data_Center	7 Jun 202211:55	–	githubexploit
GithubExploit	Exploit for Path Traversal in Atlassian Confluence_Server	10 Apr 201902:22	–	githubexploit
GithubExploit	Exploit for Path Traversal in Atlassian Confluence	30 Aug 201907:44	–	githubexploit
GithubExploit	Exploit for Path Traversal in Atlassian Confluence_Server	1 Feb 202116:10	–	githubexploit
GithubExploit	Exploit for Path Traversal in Atlassian Confluence_Server	9 Apr 201906:20	–	githubexploit

NVD

Vulners

Node

atlassian confluence_serverRange<6.6.12

atlassian confluence_serverRange6.7.0–6.12.3

atlassian confluence_serverRange6.13.0–6.13.3

atlassian confluence_serverRange6.14.0–6.14.2

[
  {
    "product": "Confluence Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "6.6.12",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.12.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "next of 6.13.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.13.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "next of 6.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.14.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/46731/
packetstormsecurity	www.packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html
jira	www.jira.atlassian.com/browse/CONFSERVER-57974
packetstormsecurity	www.packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html
rapid7	www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
_template	request body	/rest/tinymce/1/macro/preview	Path traversal and server-side template injection vulnerability via the _template parameter in the Widget Connector macro endpoint.	CWE-22
spaceUserKey	request body	/rest/create-dialog/1.0/space-blueprint/create-personal-space	Step to create a personal space for the authenticated user as part of the RCE exploit chain.	CWE-22
spaceKey	query param	/rest/api/space	Used to retrieve personal space data (space ID) via REST to locate homepage and attachments for payload deployment.	CWE-22
pageId	query param	/pages/viewpageattachments.action	Endpoint used to obtain the Atlass token for CSRF-protected file upload as part of the RCE flow.	CWE-22
atl_token	upload data	/pages/doattachfile.action	Upload the Velocity template payload to the server to enable RCE.	CWE-22
file_0	upload data	/pages/doattachfile.action	Upload the Velocity template payload to the server to enable RCE.	CWE-22
confirm	upload data	/pages/doattachfile.action	Upload the Velocity template payload to the server to enable RCE.	CWE-22

17 Jun 2026 02:35Current

8.8High risk

Vulners AI Score8.8

CVSS 3.19.8

CVSS 210

EPSS0.99913

SSVC