CVE-2019-3398 Atlassian Confluence Server and Data Center Path Traversal
Remote attackers with attachment or space admin permissions can exploit path traversal to write arbitrary files, leading to remote code execution.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3398?
CVE-2019-3398 is a high-severity path traversal vulnerability in Atlassian Confluence, published on 18 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2019-3398?
It affects 1 product.
Products include Atlassian Confluence Server.
How do I fix CVE-2019-3398?
No fix has been published for CVE-2019-3398 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-3398 being exploited?
Yes. Attackers have exploited CVE-2019-3398 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Atlassian Confluence
Sources
Also known as GHSA-qv34-rfhx-fg2q.