Vulnerability CVE-2019-3398


Published: 2019-04-18

Description:
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.

Type:

CWE-22

(Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Vendor: Atlassian
Product: Confluence 
Version:
6.9.3
6.9.1
6.9
6.8.5
6.8.3
6.8.2
6.8.1
6.8
6.7.3
6.7.2
6.7.1
6.7.0
6.6.9
6.6.8
6.6.7
6.6.6
6.6.5
6.6.4
6.6.3
6.6.2
6.6.12
6.6.11
6.6.10
6.6.1
6.6
6.5.3
6.5.2
6.5.1
6.5
6.4.3
6.4.2
6.4.1
6.4
6.3.4
6.3.3
6.3.2
6.3.1
6.3
6.2.4
6.2.3
6.2.2
6.2.1
6.2
6.14.2
6.14.1
6.14.0
6.13.3
6.13.2
6.13.1
6.13.0
6.12.3
6.12.2
6.12.1
6.12
6.11.2
6.11.1
6.11
6.10.2
6.10.1
6.10
6.1.4
6.1.3
6.1.2
6.1.1
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0
5.9.9
5.9.8
5.9.7
5.9.6
5.9.5
5.9.4
5.9.3
5.9.2
5.9.14
5.9.12
5.9.11
5.9.10
5.9.1
5.8.9
5.8.8
5.8.6
5.8.5
5.8.4
5.8.2
5.8.18
5.8.17
5.8.16
5.8.15
5.8.14
5.8.13
5.8.10
5.7.6
See more versions on NVD

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9/10
10/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html
http://www.securityfocus.com/bid/108067
https://jira.atlassian.com/browse/CONFSERVER-58102
https://seclists.org/bugtraq/2019/Apr/33

Related CVE
CVE-2019-8451
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist ...
CVE-2019-8450
Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripti...
CVE-2019-8449
The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
CVE-2019-14998
The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira instance.
CVE-2019-14997
The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a reverse Prox...
CVE-2019-14996
The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName pa...
CVE-2019-14995
The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.
CVE-2019-3394
There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under <install-direct...

Copyright 2019, cxsecurity.com

 

Back to Top