Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2019-3398

Quick assessment

Affected
Atlassian Confluence
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Atlassian Confluence Server和Atlassian Data Center都是澳大利亚Atlassian公司的产品。Atlassian Confluence Server是一套专业的企业知识管理与协同软件，也可以用于构建企业WiKi。Atlassian Data Center是一套数据中心系统。 Atlassian Confluence Server和Atlassian Data Center中的downloadallattachments资源存在路径遍历漏洞，该漏洞源于网络系统或

AI Predicted 9.8 Difficulty: Easy KEV EPSS 96.84% · P100

Public Exploits 2

ExploitDB · 1 EDB-47621 [webapps]
Nuclei · 1 CVE-2019-3398.yaml [template]

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2019-3398

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Atlassian Confluence Server和Atlassian Data Center 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Atlassian Confluence Server和Atlassian Data Center都是澳大利亚Atlassian公司的产品。Atlassian Confluence Server是一套专业的企业知识管理与协同软件，也可以用于构建企业WiKi。Atlassian Data Center是一套数据中心系统。 Atlassian Confluence Server和Atlassian Data Center中的downloadallattachments资源存在路径遍历漏洞，该漏洞源于网络系统或
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Atlassian Confluence 2.0.0 ~ unspecified -

II. Public POCs for CVE-2019-3398

# POC Description Source Link Shenlong Link
1 Python script to exploit confluence path traversal vulnerability cve-2019-3398 https://github.com/superevr/cve-2019-3398 POC Details
2 None https://github.com/132231g/CVE-2019-3398 POC Details
3 Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3398.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2019-3398

请登录查看更多情报信息。

Vendor Advisories for CVE-2019-3398 (1)

Exploits & Public PoCs for CVE-2019-3398 (2)

Mailing List Discussions for CVE-2019-3398 (1)

Other References for CVE-2019-3398 (1)

IV. Related Vulnerabilities

Same product: Confluence
Same vendor: Atlassian

V. Comments for CVE-2019-3398

No comments yet

Leave a comment