Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.13, 6.7.x prior to 6.12.4, 6.13.x prior to 6.13.4, 6.14.x prior to 6.14.3 or 6.15.x prior to 6.15.2. It is, therefore, affected by a directory traversal vulnerability which exists in download all attachments component. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal characters, to write files to arbitrary locations which may lead to remote code execution.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.13, 6.7.x prior to 6.12.4, 6.13.x prior to 6.13.4, 6.14.x prior to 6.14.3 or 6.15.x prior to 6.15.2. It is, therefore, affected by a directory traversal vulnerability which exists in download all attachments component. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal characters, to write files to arbitrary locations which may lead to remote code execution. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
98637	Atlassian Confluence < 6.6.13 Directory Traversal Vulnerability	Web App Scanning	Component Vulnerability	high
98636	Atlassian Confluence 6.7.x < 6.12.4 Directory Traversal Vulnerability	Web App Scanning	Component Vulnerability	high
98635	Atlassian Confluence 6.13.x < 6.13.4 Directory Traversal Vulnerability	Web App Scanning	Component Vulnerability	high
98634	Atlassian Confluence 6.14.x < 6.14.3 Directory Traversal Vulnerability	Web App Scanning	Component Vulnerability	high
98633	Atlassian Confluence 6.15.x < 6.15.2 Directory Traversal Vulnerability	Web App Scanning	Component Vulnerability	high
124281	Atlassian Confluence < 6.6.13 / 6.7.x < 6.12.4 / 6.13.x < 6.13.4 / 6.14.x < 6.14.3 / 6.15.x < 6.15.2 Directory Traversal Vulnerability	Nessus	CGI abuses	high

Detections

Analytics

CVE-2019-3398

high

Tenable Plugins

high

high

high

high

high

high