CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2019-03-25
Atlassian Confluence Server and Data Center Widget Connector Macro Remote Code Execution (RCE) and Path Traversal Vulnerability (CVE-2019-3396) Analysis and Mitigation Guide
[Affected Scope] Atlassian Confluence Server and Data Center before 6.6.12, 6.7.0 to before 6.12.3, 6.13.0 to before 6.13.3, and 6.14.0 to before 6.14.2
[Impact] Unauthenticated remote attackers can achieve path traversal and execute arbitrary code (RCE) on the host server via Server-Side Template Injection (SSTI)
[Mitigation] Immediately upgrade Confluence to the patched versions (6.6.12, 6.12.3, 6.13.3, 6.14.2 or later) or disable the Widget Connector macro