CVE-2019-3396

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Atlassian	Confluence Server	>= unspecified, < 6.6.12; >= 6.7.0, < unspecified; >= unspecified, < 6.12.3; >= next of 6.13.0, < unspecified; >= unspecified, < 6.13.3; >= next of 6.14.0, < unspecified; >= unspecified, < 6.14.2

References

http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connectorExploit, Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CONFSERVER-57974Issue Tracking, Patch, Vendor Advisory
https://www.exploit-db.com/exploits/46731/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-Velocity-Template-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connectorExploit, Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CONFSERVER-57974Issue Tracking, Patch, Vendor Advisory
https://www.exploit-db.com/exploits/46731/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3396US Government Resource

Timeline

Published: Mar 25, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-33979.1Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 be CVE-2019-33988.8Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permi CVE-2019-33997.5The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see i CVE-2019-34006.1The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTM CVE-2019-34015.3The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumera CVE-2019-34026.1The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to CVE-2019-34035.3The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 bef CVE-2019-34047.5By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. Thi CVE-2019-34055.3In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a s CVE-2019-34098.8All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadeq CVE-2019-34108.8All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which CVE-2019-34117.5All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the We