CVE-2019-20406

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

VendorProductVersions
AtlassianConfluence Data Center>= unspecified, < 7.0.5; >= 7.1.0, < unspecified; >= unspecified, < 7.1.1

References

Timeline

Published
Feb 6, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-204074.3The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackerCVE-2019-204085.3The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal netCVE-2019-204099.8The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gaCVE-2019-20417.3In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure defCVE-2019-204106.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information DisclosurCVE-2019-204114.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgCVE-2019-204125.3The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the folCVE-2019-204137.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of SCVE-2019-204145.4Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scCVE-2019-204154.3Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-siteCVE-2019-204164.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scCVE-2019-204186.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Applic
CVE-2019-20406: High severity, CVSS 7.8 | Vulnix