Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-59428

Confluence on Windows was vulnerable to DLL hijacking - CVE-2019-20406

XMLWordPrintable

      The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a dll file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.

      Acknowledgment

      We would like to thank Peleg Hadar of SafeBreach Labs for reporting this vulnerability.

            [CONFSERVER-59428] Confluence on Windows was vulnerable to DLL hijacking - CVE-2019-20406

            David Sumlin added a comment - - edited

            Why isn't the Long Term Support version 6.13.x being updated to address this vulnerability? I thought that was the whole promise of the Long Term Support concept?

            David Sumlin added a comment - - edited Why isn't the Long Term Support version 6.13.x being updated to address this vulnerability? I thought that was the whole promise of the Long Term Support concept?

            Security Metrics Bot added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment.
            CVSS v3 score: 6.7 => Medium severity

            Exploitability Metrics

            Attack Vector Local
            Attack Complexity High
            Privileges Required Low
            User Interaction Required

            Scope Metric

            Scope Unchanged

            Impact Metrics

            Confidentiality High
            Integrity High
            Availability High

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

            Security Metrics Bot added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 6.7 => Medium severity Exploitability Metrics Attack Vector Local Attack Complexity High Privileges Required Low User Interaction Required Scope Metric Scope Unchanged Impact Metrics Confidentiality High Integrity High Availability High https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: