CVE-2019-3398

Atlassian Confluence Server and Data Center Path Traversal Vulnerability

Confluence Server

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center…

18. Apr 2019

Ausgewertete Quellen

• Hersteller
  https://jira.atlassian.com/browse/CONFSERVER-58102
• Hinweis
  http://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html
• Hinweis
  http://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html
• Hinweis
  http://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.html
• Hinweis
  http://www.securityfocus.com/bid/108067
• Hinweis
  https://seclists.org/bugtraq/2019/Apr/33
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3398
• CISA
  Atlassian Confluence Server and Data Center Path Traversal Vulnerability
• NVD
  CVE-2019-3398