Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2019-3396

At a glance

Severity
CRITICAL 9.8
Exploitation
Known exploited (CISA KEV) · added 2021-11-03
Exploited per ENISA since 2021-11-03
EPSS
EPSS 99.91 % · percentile 100 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
atlassian
NVD status
Analyzed

Description

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 2.0HIGH 10.0AV:N/AC:L/Au:N/C:C/I:C/A:CNVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Atlassian · Confluence Serveraffected unspecified < 6.6.12 ; affected 6.7.0 < unspecified ; affected unspecified < 6.12.3 ; affected next of 6.13.0 < unspecified ; affected unspecified < 6.13.3 ; affected next of 6.14.0 < unspecified

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
CISA Known Exploited VulnerabilitiesCC0 1.0
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD