{"cve_id":"CVE-2019-3396","summary":"The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.","cvss":9.8,"cvss_version":3.0,"cvss_v2":10.0,"cvss_v3":9.8,"epss":0.94471,"ranking_epss":0.99998,"kev":true,"propose_action":"Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.","ransomware_campaign":"Known","references":["http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html","http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html","http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector","https://jira.atlassian.com/browse/CONFSERVER-57974","https://www.exploit-db.com/exploits/46731/","http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.html","http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.html","http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector","https://jira.atlassian.com/browse/CONFSERVER-57974","https://www.exploit-db.com/exploits/46731/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3396"],"published_time":"2019-03-25T19:29:01","cpes":["cpe:2.3:a:atlassian:confluence_server:-","cpe:2.3:a:atlassian:confluence_server:1.0","cpe:2.3:a:atlassian:confluence_server:1.0.1","cpe:2.3:a:atlassian:confluence_server:1.0.3","cpe:2.3:a:atlassian:confluence_server:1.1","cpe:2.3:a:atlassian:confluence_server:1.1.1","cpe:2.3:a:atlassian:confluence_server:1.1.2","cpe:2.3:a:atlassian:confluence_server:1.2","cpe:2.3:a:atlassian:confluence_server:1.2.1","cpe:2.3:a:atlassian:confluence_server:1.2.2","cpe:2.3:a:atlassian:confluence_server:1.2.3","cpe:2.3:a:atlassian:confluence_server:1.3","cpe:2.3:a:atlassian:confluence_server:1.3.1","cpe:2.3:a:atlassian:confluence_server:1.3.2","cpe:2.3:a:atlassian:confluence_server:1.3.4","cpe:2.3:a:atlassian:confluence_server:1.3.5","cpe:2.3:a:atlassian:confluence_server:1.3.6","cpe:2.3:a:atlassian:confluence_server:1.4","cpe:2.3:a:atlassian:confluence_server:1.4.1","cpe:2.3:a:atlassian:confluence_server:1.4.2","cpe:2.3:a:atlassian:confluence_server:1.4.3","cpe:2.3:a:atlassian:confluence_server:1.4.4","cpe:2.3:a:atlassian:confluence_server:2.0","cpe:2.3:a:atlassian:confluence_server:2.0.1","cpe:2.3:a:atlassian:confluence_server:2.0.2","cpe:2.3:a:atlassian:confluence_server:2.0.3","cpe:2.3:a:atlassian:confluence_server:2.1","cpe:2.3:a:atlassian:confluence_server:2.1.1","cpe:2.3:a:atlassian:confluence_server:2.1.2","cpe:2.3:a:atlassian:confluence_server:2.1.3","cpe:2.3:a:atlassian:confluence_server:2.1.4","cpe:2.3:a:atlassian:confluence_server:2.1.5","cpe:2.3:a:atlassian:confluence_server:2.10","cpe:2.3:a:atlassian:confluence_server:2.10.1","cpe:2.3:a:atlassian:confluence_server:2.10.2","cpe:2.3:a:atlassian:confluence_server:2.10.3","cpe:2.3:a:atlassian:confluence_server:2.10.4","cpe:2.3:a:atlassian:confluence_server:2.2","cpe:2.3:a:atlassian:confluence_server:2.2.1","cpe:2.3:a:atlassian:confluence_server:2.2.10","cpe:2.3:a:atlassian:confluence_server:2.2.2","cpe:2.3:a:atlassian:confluence_server:2.2.3","cpe:2.3:a:atlassian:confluence_server:2.2.4","cpe:2.3:a:atlassian:confluence_server:2.2.5","cpe:2.3:a:atlassian:confluence_server:2.2.6a","cpe:2.3:a:atlassian:confluence_server:2.2.7","cpe:2.3:a:atlassian:confluence_server:2.2.8","cpe:2.3:a:atlassian:confluence_server:2.2.9","cpe:2.3:a:atlassian:confluence_server:2.3","cpe:2.3:a:atlassian:confluence_server:2.3.1","cpe:2.3:a:atlassian:confluence_server:2.3.2","cpe:2.3:a:atlassian:confluence_server:2.3.3","cpe:2.3:a:atlassian:confluence_server:2.4","cpe:2.3:a:atlassian:confluence_server:2.4.2","cpe:2.3:a:atlassian:confluence_server:2.4.3","cpe:2.3:a:atlassian:confluence_server:2.4.4","cpe:2.3:a:atlassian:confluence_server:2.4.5","cpe:2.3:a:atlassian:confluence_server:2.5","cpe:2.3:a:atlassian:confluence_server:2.5.1","cpe:2.3:a:atlassian:confluence_server:2.5.2","cpe:2.3:a:atlassian:confluence_server:2.5.3","cpe:2.3:a:atlassian:confluence_server:2.5.4","cpe:2.3:a:atlassian:confluence_server:2.5.5","cpe:2.3:a:atlassian:confluence_server:2.5.6","cpe:2.3:a:atlassian:confluence_server:2.5.7","cpe:2.3:a:atlassian:confluence_server:2.5.8","cpe:2.3:a:atlassian:confluence_server:2.6","cpe:2.3:a:atlassian:confluence_server:2.6.1","cpe:2.3:a:atlassian:confluence_server:2.6.2","cpe:2.3:a:atlassian:confluence_server:2.6.3","cpe:2.3:a:atlassian:confluence_server:2.7","cpe:2.3:a:atlassian:confluence_server:2.7.1","cpe:2.3:a:atlassian:confluence_server:2.7.2","cpe:2.3:a:atlassian:confluence_server:2.7.3","cpe:2.3:a:atlassian:confluence_server:2.7.4","cpe:2.3:a:atlassian:confluence_server:2.8","cpe:2.3:a:atlassian:confluence_server:2.8.1","cpe:2.3:a:atlassian:confluence_server:2.8.2","cpe:2.3:a:atlassian:confluence_server:2.8.3","cpe:2.3:a:atlassian:confluence_server:2.9","cpe:2.3:a:atlassian:confluence_server:2.9.1","cpe:2.3:a:atlassian:confluence_server:2.9.2","cpe:2.3:a:atlassian:confluence_server:2.9.3","cpe:2.3:a:atlassian:confluence_server:3.0","cpe:2.3:a:atlassian:confluence_server:3.0.1","cpe:2.3:a:atlassian:confluence_server:3.0.2","cpe:2.3:a:atlassian:confluence_server:3.1","cpe:2.3:a:atlassian:confluence_server:3.1.1","cpe:2.3:a:atlassian:confluence_server:3.1.2","cpe:2.3:a:atlassian:confluence_server:3.2","cpe:2.3:a:atlassian:confluence_server:3.2.1","cpe:2.3:a:atlassian:confluence_server:3.3","cpe:2.3:a:atlassian:confluence_server:3.3.1","cpe:2.3:a:atlassian:confluence_server:3.3.3","cpe:2.3:a:atlassian:confluence_server:3.4","cpe:2.3:a:atlassian:confluence_server:3.4.1","cpe:2.3:a:atlassian:confluence_server:3.4.2","cpe:2.3:a:atlassian:confluence_server:3.4.3","cpe:2.3:a:atlassian:confluence_server:3.4.5","cpe:2.3:a:atlassian:confluence_server:3.4.6","cpe:2.3:a:atlassian:confluence_server:3.4.7","cpe:2.3:a:atlassian:confluence_server:3.4.8","cpe:2.3:a:atlassian:confluence_server:3.4.9","cpe:2.3:a:atlassian:confluence_server:3.5","cpe:2.3:a:atlassian:confluence_server:3.5.1","cpe:2.3:a:atlassian:confluence_server:3.5.11","cpe:2.3:a:atlassian:confluence_server:3.5.13","cpe:2.3:a:atlassian:confluence_server:3.5.16","cpe:2.3:a:atlassian:confluence_server:3.5.17","cpe:2.3:a:atlassian:confluence_server:3.5.2","cpe:2.3:a:atlassian:confluence_server:3.5.3","cpe:2.3:a:atlassian:confluence_server:3.5.4","cpe:2.3:a:atlassian:confluence_server:3.5.5","cpe:2.3:a:atlassian:confluence_server:3.5.6","cpe:2.3:a:atlassian:confluence_server:3.5.7","cpe:2.3:a:atlassian:confluence_server:3.5.9","cpe:2.3:a:atlassian:confluence_server:4.0","cpe:2.3:a:atlassian:confluence_server:4.0.3","cpe:2.3:a:atlassian:confluence_server:4.0.4","cpe:2.3:a:atlassian:confluence_server:4.0.5","cpe:2.3:a:atlassian:confluence_server:4.0.7","cpe:2.3:a:atlassian:confluence_server:4.1","cpe:2.3:a:atlassian:confluence_server:4.1.10","cpe:2.3:a:atlassian:confluence_server:4.1.2","cpe:2.3:a:atlassian:confluence_server:4.1.3","cpe:2.3:a:atlassian:confluence_server:4.1.4","cpe:2.3:a:atlassian:confluence_server:4.1.5","cpe:2.3:a:atlassian:confluence_server:4.1.6","cpe:2.3:a:atlassian:confluence_server:4.1.7","cpe:2.3:a:atlassian:confluence_server:4.1.9","cpe:2.3:a:atlassian:confluence_server:4.2.0","cpe:2.3:a:atlassian:confluence_server:4.2.1","cpe:2.3:a:atlassian:confluence_server:4.2.11","cpe:2.3:a:atlassian:confluence_server:4.2.12","cpe:2.3:a:atlassian:confluence_server:4.2.13","cpe:2.3:a:atlassian:confluence_server:4.2.2","cpe:2.3:a:atlassian:confluence_server:4.2.3","cpe:2.3:a:atlassian:confluence_server:4.2.4","cpe:2.3:a:atlassian:confluence_server:4.2.5","cpe:2.3:a:atlassian:confluence_server:4.2.6","cpe:2.3:a:atlassian:confluence_server:4.2.7","cpe:2.3:a:atlassian:confluence_server:4.2.8","cpe:2.3:a:atlassian:confluence_server:4.3","cpe:2.3:a:atlassian:confluence_server:4.3.1","cpe:2.3:a:atlassian:confluence_server:4.3.2","cpe:2.3:a:atlassian:confluence_server:4.3.3","cpe:2.3:a:atlassian:confluence_server:4.3.5","cpe:2.3:a:atlassian:confluence_server:4.3.6","cpe:2.3:a:atlassian:confluence_server:4.3.7","cpe:2.3:a:atlassian:confluence_server:5.0","cpe:2.3:a:atlassian:confluence_server:5.0.1","cpe:2.3:a:atlassian:confluence_server:5.0.2","cpe:2.3:a:atlassian:confluence_server:5.0.3","cpe:2.3:a:atlassian:confluence_server:5.1","cpe:2.3:a:atlassian:confluence_server:5.1.1","cpe:2.3:a:atlassian:confluence_server:5.1.2","cpe:2.3:a:atlassian:confluence_server:5.1.3","cpe:2.3:a:atlassian:confluence_server:5.1.4","cpe:2.3:a:atlassian:confluence_server:5.1.5","cpe:2.3:a:atlassian:confluence_server:5.10.0","cpe:2.3:a:atlassian:confluence_server:5.10.1","cpe:2.3:a:atlassian:confluence_server:5.10.2","cpe:2.3:a:atlassian:confluence_server:5.10.3","cpe:2.3:a:atlassian:confluence_server:5.10.4","cpe:2.3:a:atlassian:confluence_server:5.10.5","cpe:2.3:a:atlassian:confluence_server:5.10.6","cpe:2.3:a:atlassian:confluence_server:5.10.7","cpe:2.3:a:atlassian:confluence_server:5.10.8","cpe:2.3:a:atlassian:confluence_server:5.10.9","cpe:2.3:a:atlassian:confluence_server:5.2.3","cpe:2.3:a:atlassian:confluence_server:5.2.4","cpe:2.3:a:atlassian:confluence_server:5.2.5","cpe:2.3:a:atlassian:confluence_server:5.3","cpe:2.3:a:atlassian:confluence_server:5.3.1","cpe:2.3:a:atlassian:confluence_server:5.3.4","cpe:2.3:a:atlassian:confluence_server:5.4","cpe:2.3:a:atlassian:confluence_server:5.4.1","cpe:2.3:a:atlassian:confluence_server:5.4.2","cpe:2.3:a:atlassian:confluence_server:5.4.3","cpe:2.3:a:atlassian:confluence_server:5.4.4","cpe:2.3:a:atlassian:confluence_server:5.5","cpe:2.3:a:atlassian:confluence_server:5.5.0","cpe:2.3:a:atlassian:confluence_server:5.5.1","cpe:2.3:a:atlassian:confluence_server:5.5.2","cpe:2.3:a:atlassian:confluence_server:5.5.3","cpe:2.3:a:atlassian:confluence_server:5.5.6","cpe:2.3:a:atlassian:confluence_server:5.5.7","cpe:2.3:a:atlassian:confluence_server:5.6","cpe:2.3:a:atlassian:confluence_server:5.6.1","cpe:2.3:a:atlassian:confluence_server:5.6.3","cpe:2.3:a:atlassian:confluence_server:5.6.4","cpe:2.3:a:atlassian:confluence_server:5.6.5","cpe:2.3:a:atlassian:confluence_server:5.6.6","cpe:2.3:a:atlassian:confluence_server:5.7","cpe:2.3:a:atlassian:confluence_server:5.7.1","cpe:2.3:a:atlassian:confluence_server:5.7.3","cpe:2.3:a:atlassian:confluence_server:5.7.4","cpe:2.3:a:atlassian:confluence_server:5.7.5","cpe:2.3:a:atlassian:confluence_server:5.7.6","cpe:2.3:a:atlassian:confluence_server:5.8.10","cpe:2.3:a:atlassian:confluence_server:5.8.13","cpe:2.3:a:atlassian:confluence_server:5.8.14","cpe:2.3:a:atlassian:confluence_server:5.8.15","cpe:2.3:a:atlassian:confluence_server:5.8.16","cpe:2.3:a:atlassian:confluence_server:5.8.17","cpe:2.3:a:atlassian:confluence_server:5.8.18","cpe:2.3:a:atlassian:confluence_server:5.8.2","cpe:2.3:a:atlassian:confluence_server:5.8.4","cpe:2.3:a:atlassian:confluence_server:5.8.5","cpe:2.3:a:atlassian:confluence_server:5.8.6","cpe:2.3:a:atlassian:confluence_server:5.8.8","cpe:2.3:a:atlassian:confluence_server:5.8.9","cpe:2.3:a:atlassian:confluence_server:5.9.1","cpe:2.3:a:atlassian:confluence_server:5.9.10","cpe:2.3:a:atlassian:confluence_server:5.9.11","cpe:2.3:a:atlassian:confluence_server:5.9.12","cpe:2.3:a:atlassian:confluence_server:5.9.14","cpe:2.3:a:atlassian:confluence_server:5.9.2","cpe:2.3:a:atlassian:confluence_server:5.9.3","cpe:2.3:a:atlassian:confluence_server:5.9.4","cpe:2.3:a:atlassian:confluence_server:5.9.5","cpe:2.3:a:atlassian:confluence_server:5.9.6","cpe:2.3:a:atlassian:confluence_server:5.9.7","cpe:2.3:a:atlassian:confluence_server:5.9.8","cpe:2.3:a:atlassian:confluence_server:5.9.9","cpe:2.3:a:atlassian:confluence_server:6.0.0","cpe:2.3:a:atlassian:confluence_server:6.0.1","cpe:2.3:a:atlassian:confluence_server:6.0.2","cpe:2.3:a:atlassian:confluence_server:6.0.3","cpe:2.3:a:atlassian:confluence_server:6.0.4","cpe:2.3:a:atlassian:confluence_server:6.0.5","cpe:2.3:a:atlassian:confluence_server:6.0.6","cpe:2.3:a:atlassian:confluence_server:6.0.7","cpe:2.3:a:atlassian:confluence_server:6.1.0","cpe:2.3:a:atlassian:confluence_server:6.1.1","cpe:2.3:a:atlassian:confluence_server:6.1.2","cpe:2.3:a:atlassian:confluence_server:6.1.3","cpe:2.3:a:atlassian:confluence_server:6.1.4","cpe:2.3:a:atlassian:confluence_server:6.10.0","cpe:2.3:a:atlassian:confluence_server:6.10.1","cpe:2.3:a:atlassian:confluence_server:6.10.2","cpe:2.3:a:atlassian:confluence_server:6.10.3","cpe:2.3:a:atlassian:confluence_server:6.11.0","cpe:2.3:a:atlassian:confluence_server:6.11.1","cpe:2.3:a:atlassian:confluence_server:6.11.2","cpe:2.3:a:atlassian:confluence_server:6.12.0","cpe:2.3:a:atlassian:confluence_server:6.12.1","cpe:2.3:a:atlassian:confluence_server:6.12.2","cpe:2.3:a:atlassian:confluence_server:6.13.0","cpe:2.3:a:atlassian:confluence_server:6.13.1","cpe:2.3:a:atlassian:confluence_server:6.13.2","cpe:2.3:a:atlassian:confluence_server:6.14.0","cpe:2.3:a:atlassian:confluence_server:6.14.1","cpe:2.3:a:atlassian:confluence_server:6.2.0","cpe:2.3:a:atlassian:confluence_server:6.2.1","cpe:2.3:a:atlassian:confluence_server:6.2.2","cpe:2.3:a:atlassian:confluence_server:6.2.3","cpe:2.3:a:atlassian:confluence_server:6.2.4","cpe:2.3:a:atlassian:confluence_server:6.3.0","cpe:2.3:a:atlassian:confluence_server:6.3.1","cpe:2.3:a:atlassian:confluence_server:6.3.2","cpe:2.3:a:atlassian:confluence_server:6.3.3","cpe:2.3:a:atlassian:confluence_server:6.3.4","cpe:2.3:a:atlassian:confluence_server:6.4.0","cpe:2.3:a:atlassian:confluence_server:6.4.1","cpe:2.3:a:atlassian:confluence_server:6.4.2","cpe:2.3:a:atlassian:confluence_server:6.4.3","cpe:2.3:a:atlassian:confluence_server:6.5.0","cpe:2.3:a:atlassian:confluence_server:6.5.1","cpe:2.3:a:atlassian:confluence_server:6.5.2","cpe:2.3:a:atlassian:confluence_server:6.5.3","cpe:2.3:a:atlassian:confluence_server:6.6.0","cpe:2.3:a:atlassian:confluence_server:6.6.1","cpe:2.3:a:atlassian:confluence_server:6.6.10","cpe:2.3:a:atlassian:confluence_server:6.6.11","cpe:2.3:a:atlassian:confluence_server:6.6.2","cpe:2.3:a:atlassian:confluence_server:6.6.3","cpe:2.3:a:atlassian:confluence_server:6.6.4","cpe:2.3:a:atlassian:confluence_server:6.6.5","cpe:2.3:a:atlassian:confluence_server:6.6.6","cpe:2.3:a:atlassian:confluence_server:6.6.7","cpe:2.3:a:atlassian:confluence_server:6.6.8","cpe:2.3:a:atlassian:confluence_server:6.6.9","cpe:2.3:a:atlassian:confluence_server:6.7.0","cpe:2.3:a:atlassian:confluence_server:6.7.1","cpe:2.3:a:atlassian:confluence_server:6.7.2","cpe:2.3:a:atlassian:confluence_server:6.7.3","cpe:2.3:a:atlassian:confluence_server:6.8.0","cpe:2.3:a:atlassian:confluence_server:6.8.1","cpe:2.3:a:atlassian:confluence_server:6.8.2","cpe:2.3:a:atlassian:confluence_server:6.8.3","cpe:2.3:a:atlassian:confluence_server:6.8.5","cpe:2.3:a:atlassian:confluence_server:6.9.0","cpe:2.3:a:atlassian:confluence_server:6.9.1","cpe:2.3:a:atlassian:confluence_server:6.9.3"]}