What’s Vulnerable › Vulnerabilities

CVE-2019-20406

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-06 · updated 2026-06-17
• Weakness: CWE-427

Description

The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.

Affected products

• Atlassian Confluence: before 7.0.5 — fixed in 7.0.5
• Atlassian Confluence Data Center: 7.1.0

How to fix

Upgrade to a fixed version: Atlassian Confluence 7.0.5. Check the vendor advisory for mitigations.

References

• https://jira.atlassian.com/browse/CONFSERVER-59428
• https://jira.atlassian.com/browse/CONFSERVER-59428

Get alerted when CVE-2019-20406 or the next vulnerability affects your stack