• Type: Bug
• Resolution: Fixed
• Priority: Highest
• Fix Version/s: 6.6.13, 6.13.4, 6.10.3, 6.12.4, 6.14.3, 6.15.2
• Affects Version/s: 2.0.0
• Component/s: Content - Page
• Labels:

  • CVE-2019-3398
  • advisory
  • advisory-released
  • cvss-critical
  • idor
  • path-traversal
  • security

[CONFSERVER-58102] Confluence - Path traversal vulnerability - CVE-2019-3398

set-jac-bot made changes - 22/May/2020 8:23 AM

Fixed in Enterprise Release/s

New: [Download 6.6, 6.13|https://confluence.atlassian.com/enterprise/atlassian-enterprise-releases-948227420.html]

Said made changes - 17/Feb/2020 5:14 AM

Remote Link

New: This issue links to "Page (Confluence)" [ 471233 ]

Said made changes - 10/Dec/2019 5:24 AM

Labels

Original: CVE-2019-3398 advisory advisory-released cvss-critical path-traversal

New: CVE-2019-3398 advisory advisory-released cvss-critical idor path-traversal security

David Black made changes - 12/Aug/2019 3:00 AM

Labels

Original: CVE-2019-3398 advisory advisory-to-release cvss-critical path-traversal

New: CVE-2019-3398 advisory advisory-released cvss-critical path-traversal

Rachel Robins made changes - 07/Jun/2019 12:43 AM

Fix Version/s		New: 6.10.3 [ 86394 ]
Fix Version/s	Original: 60.10.3 [ 87597 ]

Quan Pham made changes - 06/Jun/2019 4:29 AM

Fix Version/s

New: 60.10.3 [ 87597 ]

Security Metrics Bot made changes - 17/Apr/2019 4:52 PM

Security

Original: Reporter and Atlassian Staff [ 10751 ]

David Black made changes - 03/Apr/2019 2:33 AM

Description

Original: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. *Affected versions:* * All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability. *Fix:*  * Confluence Server and Data Center versions 6.15.2 is available for download from [https://www.atlassian.com/software/confluence/download].  * Confluence Server and Data Center versions 6.14.3 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.13.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.12.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.6.13 is available for download from [https://www.atlassian.com/software/confluence/download-archives]. For additional details, see the [full advisory|https://confluence.atlassian.com/x/d5e8OQ].

New: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. *Affected versions:* * All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability. *Fix:*  * Confluence Server and Data Center versions 6.15.2 is available for download from [https://www.atlassian.com/software/confluence/download].  * Confluence Server and Data Center versions 6.14.3 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.13.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.12.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.6.13 is available for download from [https://www.atlassian.com/software/confluence/download-archives]. For additional details, see the [full advisory|https://confluence.atlassian.com/x/d5e8OQ].

David Black made changes - 02/Apr/2019 9:49 PM

Description

Original: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. *Affected versions:* * All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability. *Fix:*  * Confluence Server version 6.15.2 is available for download from [https://www.atlassian.com/software/confluence/download].  * Confluence Server version 6.14.3 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.13.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.12.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.6.13 is available for download from [https://www.atlassian.com/software/confluence/download-archives]. For additional details, see the [full advisory|https://confluence.atlassian.com/x/d5e8OQ].

New: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. *Affected versions:* * All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability. *Fix:*  * Confluence Server and Data Center versions 6.15.2 is available for download from [https://www.atlassian.com/software/confluence/download].  * Confluence Server and Data Center versions 6.14.3 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.13.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.12.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server and Data Center versions 6.6.13 is available for download from [https://www.atlassian.com/software/confluence/download-archives]. For additional details, see the [full advisory|https://confluence.atlassian.com/x/d5e8OQ].

David Black made changes - 02/Apr/2019 9:48 PM

Description

Original: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and or blogs can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. *Affected versions:* * All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability. *Fix:*  * Confluence Server version 6.15.2 is available for download from [https://www.atlassian.com/software/confluence/download].  * Confluence Server version 6.14.3 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.13.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.12.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.6.13 is available for download from [https://www.atlassian.com/software/confluence/download-archives]. For additional details, see the [full advisory|https://confluence.atlassian.com/x/d5e8OQ].

New: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. *Affected versions:* * All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability. *Fix:*  * Confluence Server version 6.15.2 is available for download from [https://www.atlassian.com/software/confluence/download].  * Confluence Server version 6.14.3 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.13.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.12.4 is available for download from [https://www.atlassian.com/software/confluence/download-archives].  * Confluence Server version 6.6.13 is available for download from [https://www.atlassian.com/software/confluence/download-archives]. For additional details, see the [full advisory|https://confluence.atlassian.com/x/d5e8OQ].

Load more older history items