CVE-2019-3398
Description
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
How to fix
Apply updates per vendor instructions.
CISA due date: May 3, 2022- atlassian confluence_server6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian confluence_server | 2.0 ≤ v < 6.6.13, 6.7.0 ≤ v < 6.12.4, 6.13.0 ≤ v < 6.13.4, 6.14.0 ≤ v < 6.14.3, 6.15.0 ≤ v < 6.15.2 | 6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.