CVE-2019-3396: critical vulnerability in Atlassian Confluence Server
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
A flaw in Atlassian Confluence's Widget Connector macro allows attackers to manipulate file paths and execute harmful code on the server by injecting malicious templates. This affects multiple versions and can lead to complete system compromise.
The Widget Connector macro is vulnerable to server-side template injection (SSTI), enabling path traversal (CWE-22) and remote code execution. An unauthenticated remote attacker can exploit this by crafting malicious template input, affecting Confluence Server and Data Center deployments across multiple version branches.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.