CVE-2019-3398

🗓️ 18 Apr 2019 17:21:37Reported by atlassianType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1118 Views🌐 WEB

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource, allowing remote code execution

Reporter	Title	Published	Views	Family All 33
zdt	Confluence Server / Data Center Path Traversal Vulnerability	24 Apr 201900:00	–	zdt
zdt	Atlassian Confluence 6.15.1 - Directory Traversal Vulnerability	12 Nov 201900:00	–	zdt
zdt	Atlassian Confluence 6.15.1 - Directory Traversal Exploit	12 Nov 201900:00	–	zdt
ATTACKERKB	CVE-2019-3398	18 Apr 201900:00	–	attackerkb
Atlassian	Confluence - Path traversal vulnerability - CVE-2019-3398	31 Mar 201921:40	–	atlassian
Atlassian	Confluence - Path traversal vulnerability - CVE-2019-3398	31 Mar 201921:40	–	atlassian
BDU FSTEC	The vulnerability in the Atlassian Confluence Server’s web server exists due to an incorrect path name limitation for the restricted access catalog. This allows a hacker to write files anywhere and execute any code.	15 May 202000:00	–	bdu_fstec
Circl	CVE-2019-3398	9 Dec 202007:18	–	circl
CISA KEV Catalog	Atlassian Confluence Server and Data Center Path Traversal Vulnerability	3 Nov 202100:00	–	cisa_kev
Tenable Nessus	Atlassian Confluence < 6.6.13 / 6.7.x < 6.12.4 / 6.13.x < 6.13.4 / 6.14.x < 6.14.3 / 6.15.x < 6.15.2 Directory Traversal Vulnerability	25 Apr 201900:00	–	nessus

NVD

Vulners

Node

atlassian confluence_serverRange2.0–6.6.13

atlassian confluence_serverRange6.7.0–6.12.4

atlassian confluence_serverRange6.13.0–6.13.4

atlassian confluence_serverRange6.14.0–6.14.3

atlassian confluence_serverRange6.15.0–6.15.2

[
  {
    "product": "Confluence",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.6.13",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.12.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.13.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.13.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.14.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "6.15.0",
        "versionType": "custom"
      },
      {
        "lessThan": "6.15.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jira	www.jira.atlassian.com/browse/CONFSERVER-58102
packetstormsecurity	www.packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.html
packetstormsecurity	www.packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html
seclists	www.seclists.org/bugtraq/2019/Apr/33
securityfocus	www.securityfocus.com/bid/108067
packetstormsecurity	www.packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
pageId	query param	\/pages\/downloadallattachments.action	Path traversal vulnerability in download all attachments endpoint allowing arbitrary file write	CWE-22
pageId	nested	\/plugins\/drag-and-drop\/upload.action	Shellcode/file upload endpoint that can be abused with crafted payload and path traversal in filename to write to arbitrary locations	CWE-22
filename	nested	\/plugins\/drag-and-drop\/upload.action	Shellcode/file upload endpoint that can be abused with crafted payload and path traversal in filename to write to arbitrary locations	CWE-22
size	nested	\/plugins\/drag-and-drop\/upload.action	Shellcode/file upload endpoint that can be abused with crafted payload and path traversal in filename to write to arbitrary locations	CWE-22
mimeType	nested	\/plugins\/drag-and-drop\/upload.action	Shellcode/file upload endpoint that can be abused with crafted payload and path traversal in filename to write to arbitrary locations	CWE-22
spaceKey	nested	\/plugins\/drag-and-drop\/upload.action	Shellcode/file upload endpoint that can be abused with crafted payload and path traversal in filename to write to arbitrary locations	CWE-22
atl_token	nested	\/plugins\/drag-and-drop\/upload.action	Shellcode/file upload endpoint that can be abused with crafted payload and path traversal in filename to write to arbitrary locations	CWE-22
name	nested	\/plugins\/drag-and-drop\/upload.action	Shellcode/file upload endpoint that can be abused with crafted payload and path traversal in filename to write to arbitrary locations	CWE-22
key	request body	\/rest\/api\/space	REST API to create a new space which can be abused to establish writable context for further exploitation	CWE-22
name	request body	\/rest\/api\/space	REST API to create a new space which can be abused to establish writable context for further exploitation	CWE-22

17 Jun 2026 02:35Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

CVSS 29

EPSS0.96837

SSVC