CVE-2019-3398
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Description
CVE-2019-3398 is a HIGH vulnerability affecting Atlassian Confluence Server and Data Center, carrying a CVSS 3.1 score of 8.8. Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution. Affected products include atlassian confluence server (>= 2.0, < 6.6.13; >= 6.7.0, < 6.12.4; >= 6.13.0, < 6.13.4; >= 6.14.0, < 6.14.3; >= 6.15.0, < 6.15.2). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.93707 (99.85th percentile), this vulnerability demonstrates significant real-world exploitation activity and should be prioritized for immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| atlassian | confluence server | >= 2.0, < 6.6.13; >= 6.7.0, < 6.12.4; >= 6.13.0, < 6.13.4; >= 6.14.0, < 6.14.3; >= 6.15.0, < 6.15.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.html(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/108067(Broken Link, Third Party Advisory, VDB Entry)
- https://jira.atlassian.com/browse/CONFSERVER-58102(Issue Tracking, Patch, Vendor Advisory)
- https://seclists.org/bugtraq/2019/Apr/33(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3398(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2019-3398 is classified under CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). This weakness category describes flaws where user-supplied input is used to construct a pathname that is intended to identify a file or directory below a restricted parent directory, but the software does not properly neutralize special elements such as ".." sequences that can resolve to a location outside of that directory. Path traversal can enable reading, writing, or deleting arbitrary files on the target system.
In the context of Atlassian Confluence Server and Data Center, this weakness is particularly concerning because path traversal in a widely-deployed collaboration platform like Confluence allows authenticated attackers to write files to arbitrary locations on the server. Since Confluence instances often contain sensitive organizational data and are accessible from internal networks, successful exploitation can lead to remote code execution and full system compromise.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2019-3398 carries a CVSS 3.1 score of 8.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker extensive access to sensitive data processed by the affected system, including configuration files, credentials, and potentially data from connected systems.
Integrity (HIGH): Attackers can modify critical system files, install backdoors, alter configurations, or deploy malware on affected systems.
Availability (HIGH): Complete disruption of the affected service or system is possible, including denial of service, system crashes, or rendering the product inoperable.
Scope Unchanged: The vulnerability's scope is Unchanged (U), meaning exploitation is contained within the vulnerable component. The impact, while significant, is limited to the affected product environment itself.
With an EPSS score of 0.93707 (99.85th percentile), this vulnerability ranks among the most likely to be exploited in real-world attacks, underscoring the urgency of remediation.
Exploit Maturity
CVE-2019-3398 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited, as confirmed by its inclusion in the KEV catalog. The EPSS score of 0.93707 (99.85th percentile) places it among the most exploited vulnerabilities tracked.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2019-3398. However, the confirmed exploitation in the wild means threat actors are actively using this vulnerability in attacks.
Attack surface: The vulnerability requires network access with low attack complexity and low privileges, requiring no user interaction. Organizations should assume exploitation tools exist and are being actively used by threat actors.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the vendor advisory for specific patch guidance and updated versions.
- Verify affected product versions in your environment. Identify all instances of Atlassian Confluence Server and Data Center in your infrastructure (affected versions: atlassian confluence server (>= 2.0, < 6.6.13; >= 6.7.0, < 6.12.4; >= 6.13.0, < 6.13.4; >= 6.14.0, < 6.14.3; >= 6.15.0, < 6.15.2)). Use asset inventory and vulnerability scanning tools to ensure no instances are missed.
- Implement interim mitigations if patching is delayed. If immediate patching is not feasible, apply network-level controls such as restricting access to the affected component, enabling enhanced logging, and monitoring for indicators of compromise.
- Scan for signs of prior exploitation. Given the confirmed active exploitation of this vulnerability, review system logs and security monitoring data for evidence of compromise. Conduct a thorough investigation if any suspicious activity is detected.
- Update detection signatures and monitoring rules. Ensure intrusion detection and prevention systems, endpoint detection tools, and SIEM rules are updated to detect exploitation attempts targeting CVE-2019-3398.
- Conduct a post-remediation review. After patching, verify the fix is effective and document the remediation actions taken. Update your vulnerability management records and assess whether any additional hardening measures are warranted.
Technical Details
CVE-2019-3398 is a HIGH-severity vulnerability in Atlassian Confluence Server and Data Center that can be exploited remotely over the network without physical access. The attack complexity is low, meaning no specialized conditions or preparation are required beyond the attack prerequisites. Low-level privileges are required to initiate the attack. No user interaction is required, allowing for fully automated exploitation.
Technical mechanism: Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects an Attack Vector of NETWORK, Attack Complexity of LOW, Privileges Required of LOW, User Interaction of NONE, Scope UNCHANGED, and impact ratings of HIGH/HIGH/HIGH for Confidentiality/Integrity/Availability respectively.
Frequently Asked Questions
Is CVE-2019-3398 being actively exploited?
Yes, CVE-2019-3398 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The EPSS score of 0.93707 (99.85th percentile) further indicates significant exploitation probability. Organizations should treat this as an urgent priority requiring immediate remediation.
What products are affected by CVE-2019-3398?
The affected products include atlassian confluence server (>= 2.0, < 6.6.13; >= 6.7.0, < 6.12.4; >= 6.13.0, < 6.13.4; >= 6.14.0, < 6.14.3; >= 6.15.0, < 6.15.2). Organizations running any of these versions should verify their exposure and prioritize remediation. Check vendor advisories for the complete and most current list of affected versions.
How do I fix CVE-2019-3398?
Apply updates per vendor instructions. Ensure all affected instances of Atlassian Confluence Server and Data Center are identified using vulnerability scanning and asset management tools. If immediate patching is not possible, implement network-level mitigations and enhanced monitoring. After patching, verify the fix and scan for indicators of prior compromise.
How severe is CVE-2019-3398?
CVE-2019-3398 is rated HIGH with a CVSS 3.1 score of 8.8. Its EPSS score of 0.93707 places it in the 99.85th percentile for exploitation likelihood. The vulnerability has confirmed active exploitation in the wild and was required to be remediated by federal agencies by 2022-05-03 per CISA's KEV directive.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.