Vulnerability CVE-2019-3398


Published: 2019-04-18

Description:
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.

Type:

CWE-22

(Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Vendor: Atlassian
Product: Confluence 
Version:
6.9.3
6.9.1
6.9
6.8.5
6.8.3
6.8.2
6.8.1
6.8
6.7.3
6.7.2
6.7.1
6.7.0
6.6.9
6.6.8
6.6.7
6.6.6
6.6.5
6.6.4
6.6.3
6.6.2
6.6.12
6.6.11
6.6.10
6.6.1
6.6
6.5.3
6.5.2
6.5.1
6.5
6.4.3
6.4.2
6.4.1
6.4
6.3.4
6.3.3
6.3.2
6.3.1
6.3
6.2.4
6.2.3
6.2.2
6.2.1
6.2
6.14.2
6.14.1
6.14.0
6.13.3
6.13.2
6.13.1
6.13.0
6.12.3
6.12.2
6.12.1
6.12
6.11.2
6.11.1
6.11
6.10.2
6.10.1
6.10
6.1.4
6.1.3
6.1.2
6.1.1
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0
5.9.9
5.9.8
5.9.7
5.9.6
5.9.5
5.9.4
5.9.3
5.9.2
5.9.14
5.9.12
5.9.11
5.9.10
5.9.1
5.8.9
5.8.8
5.8.6
5.8.5
5.8.4
5.8.2
5.8.18
5.8.17
5.8.16
5.8.15
5.8.14
5.8.13
5.8.10
5.7.6
See more versions on NVD

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9/10
10/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html
http://www.securityfocus.com/bid/108067
https://jira.atlassian.com/browse/CONFSERVER-58102
https://seclists.org/bugtraq/2019/Apr/33

Related CVE
CVE-2019-3397
Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed version for 5.14.x), from 5.15.0 before 5.15.3 (fixed version for 5.15.x), from 5.16.0 befo...
CVE-2019-11580
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerabilit...
CVE-2019-8443
The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades admin...
CVE-2019-8442
The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF direct...
CVE-2019-3403
The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
CVE-2019-3402
The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName ...
CVE-2019-3401
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
CVE-2019-3400
The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter.

Copyright 2019, cxsecurity.com

 

Back to Top